Ticket #2217: seamonkey-1.1-location_hostname-1.patch

netwerk/base/src/nsSimpleURI.cpp

@@ -155 +155 @@
     NS_EscapeURL(specPtr, specLen, esc_OnlyNonASCII|esc_AlwaysCopy, spec);
 
     PRInt32 pos = spec.FindChar(':');
-    if (pos == -1)
+    if (pos == -1 || !net_IsValidScheme(spec.get(), pos))
         return NS_ERROR_MALFORMED_URI;
 
     mScheme.Truncate();
@@ -182 +182 @@
 NS_IMETHODIMP
 nsSimpleURI::SetScheme(const nsACString &scheme)
 {
+    const nsPromiseFlatCString &flat = PromiseFlatCString(scheme);
+    if (!net_IsValidScheme(flat)) {
+        NS_ERROR("the given url scheme contains invalid characters");
+        return NS_ERROR_MALFORMED_URI;
+    }
+
     mScheme = scheme;
     ToLowerCase(mScheme);
     return NS_OK;

netwerk/base/src/nsStandardURL.cpp

@@ -504 +504 @@
     if (mHost.mLen > 0) {
         const nsCSubstring& tempHost =
             Substring(spec + mHost.mPos, spec + mHost.mPos + mHost.mLen);
+        if (tempHost.FindChar('\0') != kNotFound)
+            return NS_ERROR_MALFORMED_URI;  // null embedded in hostname
         if ((useEncHost = NormalizeIDN(tempHost, encHost)))
             approxLen += encHost.Length();
         else
@@ -1408 +1410 @@
         return NS_ERROR_UNEXPECTED;
     }
 
+    if (host && strlen(host) < flat.Length())
+        return NS_ERROR_MALFORMED_URI; // found embedded null
+
     InvalidateCache();
     mHostEncoding = eEncoding_ASCII;
 

netwerk/base/src/nsURLHelper.cpp

@@ -507 +507 @@
 PRBool
 net_IsValidScheme(const char *scheme, PRUint32 schemeLen)
 {
-    // first char much be alpha
+    // first char must be alpha
     if (!nsCRT::IsAsciiAlpha(*scheme))
         return PR_FALSE;
-    
-    for (; schemeLen && *scheme; ++scheme, --schemeLen) {
+
+    // nsCStrings may have embedded nulls -- reject those too
+    for (; schemeLen; ++scheme, --schemeLen) {
         if (!(nsCRT::IsAsciiAlpha(*scheme) ||
               nsCRT::IsAsciiDigit(*scheme) ||
               *scheme == '+' ||