162023 2016-09-15 11:03:00 -0700 URLParser: Check for invalid characters in the host 2016-09-15 11:23:30 -0700 1 1 1 Unclassified WebKit New Bugs WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 achristensen achristensen oldest_to_newest 1230094 0 achristensen 2016-09-15 11:03:00 -0700 URLParser: Check for invalid characters in the host 1230095 1 288974 achristensen 2016-09-15 11:04:33 -0700 Created attachment 288974 Patch 1230107 2 288974 achristensen 2016-09-15 11:23:22 -0700 Comment on attachment 288974 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=288974&action=review > Source/WebCore/platform/URLParser.cpp:1579 > + if (isInvalidDomainCharacter(*iterator)) > + return false; > if (*iterator == ':') > break; The check for colon should come first. The first colon means we are starting to parse the port. This is covered by API tests. 1230109 3 achristensen 2016-09-15 11:23:30 -0700 http://trac.webkit.org/changeset/205988 288974 2016-09-15 11:04:33 -0700 2016-09-15 11:05:52 -0700 Patch bug-162023-20160915110156.patch text/plain 2830 achristensen SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDIwNTkzMykKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE2IEBACisyMDE2LTA5LTE1ICBBbGV4IENo cmlzdGVuc2VuICA8YWNocmlzdGVuc2VuQHdlYmtpdC5vcmc+CisKKyAgICAgICAgVVJMUGFyc2Vy OiBDaGVjayBmb3IgaW52YWxpZCBjaGFyYWN0ZXJzIGluIHRoZSBob3N0CisgICAgICAgIGh0dHBz Oi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNjIwMjMKKworICAgICAgICBSZXZp ZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBDb3ZlcmVkIGJ5IG5ldyBBUEkgdGVz dHMuCisKKyAgICAgICAgKiBwbGF0Zm9ybS9VUkxQYXJzZXIuY3BwOgorICAgICAgICAoV2ViQ29y ZTo6VVJMUGFyc2VyOjpmYWlsdXJlKToKKyAgICAgICAgKFdlYkNvcmU6OlVSTFBhcnNlcjo6cGFy c2VIb3N0KToKKwogMjAxNi0wOS0xNCAgRXJpYyBDYXJsc29uICA8ZXJpYy5jYXJsc29uQGFwcGxl LmNvbT4KIAogICAgICAgICBbTWVkaWFTdHJlYW1dIE1pbm9yIGNsZWFudXAKSW5kZXg6IFNvdXJj ZS9XZWJDb3JlL3BsYXRmb3JtL1VSTFBhcnNlci5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dl YkNvcmUvcGxhdGZvcm0vVVJMUGFyc2VyLmNwcAkocmV2aXNpb24gMjA1OTIyKQorKysgU291cmNl L1dlYkNvcmUvcGxhdGZvcm0vVVJMUGFyc2VyLmNwcAkod29ya2luZyBjb3B5KQpAQCAtNDc1LDYg KzQ3NSw3IEBAIFVSTCBVUkxQYXJzZXI6OmZhaWx1cmUoY29uc3QgU3RyaW5nJiBpbnAKICAgICBV UkwgdXJsOwogICAgIHVybC5tX2lzVmFsaWQgPSBmYWxzZTsKICAgICB1cmwubV9wcm90b2NvbElz SW5IVFRQRmFtaWx5ID0gZmFsc2U7CisgICAgdXJsLm1fY2Fubm90QmVBQmFzZVVSTCA9IGZhbHNl OwogICAgIHVybC5tX3NjaGVtZUVuZCA9IDA7CiAgICAgdXJsLm1fdXNlclN0YXJ0ID0gMDsKICAg ICB1cmwubV91c2VyRW5kID0gMDsKQEAgLTE1NzIsNiArMTU3Myw4IEBAIGJvb2wgVVJMUGFyc2Vy OjpwYXJzZUhvc3QoU3RyaW5nVmlldzo6Q28KICAgICAgICAgZm9yICg7IGl0ZXJhdG9yICE9IGVu ZDsgKytpdGVyYXRvcikgewogICAgICAgICAgICAgaWYgKGlzVGFiT3JOZXdsaW5lKCppdGVyYXRv cikpCiAgICAgICAgICAgICAgICAgY29udGludWU7CisgICAgICAgICAgICBpZiAoaXNJbnZhbGlk RG9tYWluQ2hhcmFjdGVyKCppdGVyYXRvcikpCisgICAgICAgICAgICAgICAgcmV0dXJuIGZhbHNl OwogICAgICAgICAgICAgaWYgKCppdGVyYXRvciA9PSAnOicpCiAgICAgICAgICAgICAgICAgYnJl YWs7CiAgICAgICAgIH0KSW5kZXg6IFRvb2xzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBUb29s cy9DaGFuZ2VMb2cJKHJldmlzaW9uIDIwNTk4MykKKysrIFRvb2xzL0NoYW5nZUxvZwkod29ya2lu ZyBjb3B5KQpAQCAtMSwzICsxLDEzIEBACisyMDE2LTA5LTE1ICBBbGV4IENocmlzdGVuc2VuICA8 YWNocmlzdGVuc2VuQHdlYmtpdC5vcmc+CisKKyAgICAgICAgVVJMUGFyc2VyOiBDaGVjayBmb3Ig aW52YWxpZCBjaGFyYWN0ZXJzIGluIHRoZSBob3N0CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJr aXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNjIwMjMKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JP RFkgKE9PUFMhKS4KKworICAgICAgICAqIFRlc3RXZWJLaXRBUEkvVGVzdHMvV2ViQ29yZS9VUkxQ YXJzZXIuY3BwOgorICAgICAgICAoVGVzdFdlYktpdEFQSTo6VEVTVF9GKToKKwogMjAxNi0wOS0x NSAgRnVqaWkgSGlyb25vcmkgIDxIaXJvbm9yaS5GdWppaUBzb255LmNvbT4KIAogICAgICAgICBb Q01ha2VdIFJlZmFjdG9yIEdFTkVSQVRFX0JJTkRJTkdTCkluZGV4OiBUb29scy9UZXN0V2ViS2l0 QVBJL1Rlc3RzL1dlYkNvcmUvVVJMUGFyc2VyLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBUb29scy9UZXN0 V2ViS2l0QVBJL1Rlc3RzL1dlYkNvcmUvVVJMUGFyc2VyLmNwcAkocmV2aXNpb24gMjA1ODkzKQor KysgVG9vbHMvVGVzdFdlYktpdEFQSS9UZXN0cy9XZWJDb3JlL1VSTFBhcnNlci5jcHAJKHdvcmtp bmcgY29weSkKQEAgLTU4OCw2ICs1ODgsMTAgQEAgVEVTVF9GKFVSTFBhcnNlclRlc3QsIFBhcnNl ckZhaWx1cmVzKQogICAgIHNob3VsZEZhaWwoIi9pIiwgInNjOnNkL3NkIik7CiAgICAgc2hvdWxk RmFpbCgiP2kiLCAic2M6c2QiKTsKICAgICBzaG91bGRGYWlsKCI/aSIsICJzYzpzZC9zZCIpOwor ICAgIHNob3VsZEZhaWwoImh0dHA6Ly9leGFtcGxlIGV4YW1wbGUuY29tIiwgImh0dHA6Ly9vdGhl ci5jb20vIik7CisgICAgc2hvdWxkRmFpbCgiaHR0cDovL1t3d3cuZXhhbXBsZS5jb21dLyIsICJh Ym91dDpibGFuayIpOworICAgIHNob3VsZEZhaWwoImh0dHA6Ly8xOTIuMTY4LjAuMSBoZWxsbyIs ICJodHRwOi8vb3RoZXIuY29tLyIpOworICAgIHNob3VsZEZhaWwoImh0dHA6Ly9bZXhhbXBsZS5j b21dIiwgImh0dHA6Ly9vdGhlci5jb20vIik7CiB9CiAKIC8vIFRoZXNlIGFyZSBpbiB0aGUgc3Bl YyBidXQgbm90IGluIHRoZSB3ZWIgcGxhdGZvcm0gdGVzdHMuCg==