Strip tab and newline from Location/URL/<a>/<area>'s protocol setter

cdumez · cdumez · commit 0c6de669a59b · 2023-03-01T12:17:20.000-08:00
https://bugs.webkit.org/show_bug.cgi?id=251087 rdar://104599983 Reviewed by Alex Christensen. Our URL parser was already skipping newlines and tabs in the scheme while parsing. However, URL::setProtocol() would call URLParser::maybeCanonicalizeScheme() before parsing and this function would fail if the protocol contains any newlines or tabs. * LayoutTests/imported/w3c/web-platform-tests/html/browsers/history/the-location-interface/location-protocol-setter-expected.txt: * LayoutTests/imported/w3c/web-platform-tests/html/browsers/history/the-location-interface/location-protocol-setter-non-broken.html: * LayoutTests/imported/w3c/web-platform-tests/html/browsers/history/the-location-interface/location-protocol-setter-sameish-expected.txt: Added. * LayoutTests/imported/w3c/web-platform-tests/html/browsers/history/the-location-interface/location-protocol-setter-sameish.html: Added. * LayoutTests/imported/w3c/web-platform-tests/html/browsers/history/the-location-interface/location-protocol-setter.html: Resync tests after web-platform-tests/wpt#38032. * LayoutTests/imported/w3c/web-platform-tests/url/url-setters-stripping.any-expected.txt: * LayoutTests/imported/w3c/web-platform-tests/url/url-setters-stripping.any.worker-expected.txt: Rebaseline tests that are now passing. * Source/WTF/wtf/URLParser.cpp: (WTF::URLParser::maybeCanonicalizeScheme): Update URLParser::maybeCanonicalizeScheme() to allow for newlines and tabs in the scheme since it is allowed by the specification and our URL parser actually handles them fine. Canonical link: https://commits.webkit.org/261017@main
diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/browsers/history/the-location-interface/location-protocol-setter-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/html/browsers/history/the-location-interface/location-protocol-setter-expected.txt
@@ -1,53 +1,50 @@
 
-PASS %00 (percent-encoded) is not a scheme
-PASS %01 (percent-encoded) is not a scheme
-PASS %0A (percent-encoded) is not a scheme
-PASS %20 (percent-encoded) is not a scheme
-PASS ! (percent-encoded) is not a scheme
-PASS %7F (percent-encoded) is not a scheme
-PASS %C2%80 (percent-encoded) is not a scheme
-PASS %C3%BF (percent-encoded) is not a scheme
-PASS : (percent-encoded) is not a scheme
-PASS %C3%A2%E2%82%AC%C2%A0 (percent-encoded) is not a scheme
-PASS %00x (percent-encoded) is not a scheme
-PASS %01x (percent-encoded) is not a scheme
-PASS %0Ax (percent-encoded) is not a scheme
-PASS %20x (percent-encoded) is not a scheme
-PASS !x (percent-encoded) is not a scheme
-PASS %7Fx (percent-encoded) is not a scheme
-PASS %C2%80x (percent-encoded) is not a scheme
-PASS %C3%BFx (percent-encoded) is not a scheme
-PASS :x (percent-encoded) is not a scheme
-PASS %C3%A2%E2%82%AC%C2%A0x (percent-encoded) is not a scheme
-PASS %00X (percent-encoded) is not a scheme
-PASS %01X (percent-encoded) is not a scheme
-PASS %0AX (percent-encoded) is not a scheme
-PASS %20X (percent-encoded) is not a scheme
-PASS !X (percent-encoded) is not a scheme
-PASS %7FX (percent-encoded) is not a scheme
-PASS %C2%80X (percent-encoded) is not a scheme
-PASS %C3%BFX (percent-encoded) is not a scheme
-PASS :X (percent-encoded) is not a scheme
-PASS %C3%A2%E2%82%AC%C2%A0X (percent-encoded) is not a scheme
-PASS x%00 (percent-encoded) is not a scheme
-PASS x%01 (percent-encoded) is not a scheme
-PASS x%0A (percent-encoded) is not a scheme
-PASS x%20 (percent-encoded) is not a scheme
-PASS x! (percent-encoded) is not a scheme
-PASS x%7F (percent-encoded) is not a scheme
-PASS x%C2%80 (percent-encoded) is not a scheme
-PASS x%C3%BF (percent-encoded) is not a scheme
-PASS x%C3%A2%E2%82%AC%C2%A0 (percent-encoded) is not a scheme
-PASS X%00 (percent-encoded) is not a scheme
-PASS X%01 (percent-encoded) is not a scheme
-PASS X%0A (percent-encoded) is not a scheme
-PASS X%20 (percent-encoded) is not a scheme
-PASS X! (percent-encoded) is not a scheme
-PASS X%7F (percent-encoded) is not a scheme
-PASS X%C2%80 (percent-encoded) is not a scheme
-PASS X%C3%BF (percent-encoded) is not a scheme
-PASS X%C3%A2%E2%82%AC%C2%A0 (percent-encoded) is not a scheme
-PASS a%0A (percent-encoded) is not a scheme
-PASS a+-.%0A (percent-encoded) is not a scheme
+PASS %00 (percent-encoded here for clarity) is not a scheme
+PASS %01 (percent-encoded here for clarity) is not a scheme
+PASS %09 (percent-encoded here for clarity) is not a scheme
+PASS %0A (percent-encoded here for clarity) is not a scheme
+PASS %0C (percent-encoded here for clarity) is not a scheme
+PASS %0D (percent-encoded here for clarity) is not a scheme
+PASS %20 (percent-encoded here for clarity) is not a scheme
+PASS ! (percent-encoded here for clarity) is not a scheme
+PASS %7F (percent-encoded here for clarity) is not a scheme
+PASS %C2%80 (percent-encoded here for clarity) is not a scheme
+PASS %C3%BF (percent-encoded here for clarity) is not a scheme
+PASS : (percent-encoded here for clarity) is not a scheme
+PASS %C3%A2%E2%82%AC%C2%A0 (percent-encoded here for clarity) is not a scheme
+PASS %00x (percent-encoded here for clarity) is not a scheme
+PASS %01x (percent-encoded here for clarity) is not a scheme
+PASS %20x (percent-encoded here for clarity) is not a scheme
+PASS !x (percent-encoded here for clarity) is not a scheme
+PASS %7Fx (percent-encoded here for clarity) is not a scheme
+PASS %C2%80x (percent-encoded here for clarity) is not a scheme
+PASS %C3%BFx (percent-encoded here for clarity) is not a scheme
+PASS :x (percent-encoded here for clarity) is not a scheme
+PASS %C3%A2%E2%82%AC%C2%A0x (percent-encoded here for clarity) is not a scheme
+PASS %00X (percent-encoded here for clarity) is not a scheme
+PASS %01X (percent-encoded here for clarity) is not a scheme
+PASS %20X (percent-encoded here for clarity) is not a scheme
+PASS !X (percent-encoded here for clarity) is not a scheme
+PASS %7FX (percent-encoded here for clarity) is not a scheme
+PASS %C2%80X (percent-encoded here for clarity) is not a scheme
+PASS %C3%BFX (percent-encoded here for clarity) is not a scheme
+PASS :X (percent-encoded here for clarity) is not a scheme
+PASS %C3%A2%E2%82%AC%C2%A0X (percent-encoded here for clarity) is not a scheme
+PASS x%00 (percent-encoded here for clarity) is not a scheme
+PASS x%01 (percent-encoded here for clarity) is not a scheme
+PASS x%20 (percent-encoded here for clarity) is not a scheme
+PASS x! (percent-encoded here for clarity) is not a scheme
+PASS x%7F (percent-encoded here for clarity) is not a scheme
+PASS x%C2%80 (percent-encoded here for clarity) is not a scheme
+PASS x%C3%BF (percent-encoded here for clarity) is not a scheme
+PASS x%C3%A2%E2%82%AC%C2%A0 (percent-encoded here for clarity) is not a scheme
+PASS X%00 (percent-encoded here for clarity) is not a scheme
+PASS X%01 (percent-encoded here for clarity) is not a scheme
+PASS X%20 (percent-encoded here for clarity) is not a scheme
+PASS X! (percent-encoded here for clarity) is not a scheme
+PASS X%7F (percent-encoded here for clarity) is not a scheme
+PASS X%C2%80 (percent-encoded here for clarity) is not a scheme
+PASS X%C3%BF (percent-encoded here for clarity) is not a scheme
+PASS X%C3%A2%E2%82%AC%C2%A0 (percent-encoded here for clarity) is not a scheme
 PASS Equivalent tests for data URL and srcdoc <iframe>s
 
diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/browsers/history/the-location-interface/location-protocol-setter-non-broken.html b/LayoutTests/imported/w3c/web-platform-tests/html/browsers/history/the-location-interface/location-protocol-setter-non-broken.html
@@ -9,14 +9,15 @@
   [
     'x',
     'data',
-    // 'mailto' opens an email client in Firefox...
+    // 'mailto' opens an email client in Chrome and Firefox and then ends up passing anyway...
     'file',
     'ftp',
     'http+x'
   ].forEach((val) => {
     async_test((t) => {
       // HTTP URL <iframe>
       const frame = document.createElement("iframe")
+      t.add_cleanup(() => frame.remove())
       frame.src = "/common/blank.html"
       frame.onload = t.step_func(() => {
         frame.contentWindow.location.protocol = val
@@ -25,14 +26,17 @@
           assert_equals(frame.contentWindow.location.host, location.host)
           assert_equals(frame.contentWindow.location.port, location.port)
           t.done()
-        }, 500)
+          // Matches the timeout from location-protocol-setter-non-broken-weird.html which suggests
+          // that 4 seconds is enough for a navigation to complete.
+        }, 4000)
       })
       document.body.appendChild(frame)
     }, "Set HTTP URL frame location.protocol to " + val)
 
     async_test((t) => {
       // data URL <iframe>
       const dataFrame = document.createElement("iframe")
+      t.add_cleanup(() => dataFrame.remove())
       const channel = new MessageChannel()
       dataFrame.src = `data:text/html,<script>
 onmessage = (e) => {
@@ -42,7 +46,7 @@
   } catch(e) {
     result = true
   }
-  setTimeout(() => e.ports[0].postMessage([result, location.protocol]), 100)
+  setTimeout(() => e.ports[0].postMessage([result, location.protocol]), 4000)
 }
 <\/script>`
       dataFrame.onload = t.step_func(() => {
diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/browsers/history/the-location-interface/location-protocol-setter-sameish-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/html/browsers/history/the-location-interface/location-protocol-setter-sameish-expected.txt
@@ -0,0 +1,6 @@
+
+PASS Set location.protocol to http (percent-encoded here for clarity)
+PASS Set location.protocol to ht%0Atp (percent-encoded here for clarity)
+PASS Set location.protocol to http%0A (percent-encoded here for clarity)
+PASS Set location.protocol to %09ht%09%0AtP (percent-encoded here for clarity)
+
diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/browsers/history/the-location-interface/location-protocol-setter-sameish.html b/LayoutTests/imported/w3c/web-platform-tests/html/browsers/history/the-location-interface/location-protocol-setter-sameish.html
@@ -0,0 +1,26 @@
+<!doctype html>
+<title>Set location.protocol to the scheme it already was</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<div id=log></div>
+<iframe src=/common/blank.html></iframe>
+<iframe src=/common/blank.html></iframe>
+<iframe src=/common/blank.html></iframe>
+<iframe src=/common/blank.html></iframe>
+<script>
+self.onload = () => {
+  [
+    "http",
+    "ht\x0Atp",
+    "http\x0A",
+    "\x09ht\x09\x0AtP"
+  ].forEach((val, index) => {
+    async_test(t => {
+      self[index].frameElement.onload = t.step_func_done(() => {
+        assert_equals(self[index].location.protocol, "http:");
+      });
+      self[index].location.protocol = val;
+    }, `Set location.protocol to ${encodeURI(val)} (percent-encoded here for clarity)`);
+  });
+}
+</script>
diff --git a/LayoutTests/imported/w3c/web-platform-tests/html/browsers/history/the-location-interface/location-protocol-setter.html b/LayoutTests/imported/w3c/web-platform-tests/html/browsers/history/the-location-interface/location-protocol-setter.html
@@ -1,5 +1,5 @@
 <!doctype html>
-<title>Set location.protocol to broken schemes</title>
+<title>Set location.protocol to schemes that throw</title>
 <script src=/resources/testharness.js></script>
 <script src=/resources/testharnessreport.js></script>
 <div id=log></div>
@@ -32,14 +32,13 @@
 }
 </script>"></iframe>
 <script>
-  // Tests with '\x0A' (i.e., '\n') don't conform to the URL Standard as of the
-  // time of writing, as according to spec they should be ignored.
-  // See https://github.com/whatwg/url/issues/609.
-
-  let broken = [
+  const broken = [
     '\x00',
     '\x01',
-    '\x0A',
+    '\x09', // becomes the empty string
+    '\x0A', // becomes the empty string
+    '\x0C',
+    '\x0D',
     '\x20',
     '\x21',
     '\x7F',
@@ -49,7 +48,6 @@
     '†',
     '\x00x',
     '\x01x',
-    '\x0Ax',
     '\x20x',
     '\x21x',
     '\x7Fx',
@@ -59,7 +57,6 @@
     '†x',
     '\x00X',
     '\x01X',
-    '\x0AX',
     '\x20X',
     '\x21X',
     '\x7FX',
@@ -69,7 +66,6 @@
     '†X',
     'x\x00',
     'x\x01',
-    'x\x0A',
     'x\x20',
     'x\x21',
     'x\x7F',
@@ -78,20 +74,18 @@
     'x†',
     'X\x00',
     'X\x01',
-    'X\x0A',
     'X\x20',
     'X\x21',
     'X\x7F',
     'X\x80',
     'X\xFF',
     'X†',
-    'a\x0A',
-    'a+-.\x0A'
-  ]
-  ;broken.forEach((val) => {
+  ];
+
+  broken.forEach(val => {
     test(() => {
       assert_throws_dom("SyntaxError", () => { location.protocol = val })
-    }, encodeURI(val) + " (percent-encoded) is not a scheme")
+    }, `${encodeURI(val)} (percent-encoded here for clarity) is not a scheme`)
   })
   let c = 0
   async_test((t) => {
diff --git a/LayoutTests/imported/w3c/web-platform-tests/url/url-setters-stripping.any-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/url/url-setters-stripping.any-expected.txt
@@ -25,8 +25,8 @@ PASS Setting search with trailing U+0000 (https:)
 PASS Setting hash with leading U+0000 (https:)
 PASS Setting hash with middle U+0000 (https:)
 PASS Setting hash with trailing U+0000 (https:)
-FAIL Setting protocol with leading U+0009 (https:) assert_equals: property expected "http:" but got "https:"
-FAIL Setting protocol with U+0009 before inserted colon (https:) assert_equals: property expected "http:" but got "https:"
+PASS Setting protocol with leading U+0009 (https:)
+PASS Setting protocol with U+0009 before inserted colon (https:)
 PASS Setting username with leading U+0009 (https:)
 PASS Setting username with middle U+0009 (https:)
 PASS Setting username with trailing U+0009 (https:)
@@ -51,8 +51,8 @@ PASS Setting search with trailing U+0009 (https:)
 PASS Setting hash with leading U+0009 (https:)
 PASS Setting hash with middle U+0009 (https:)
 PASS Setting hash with trailing U+0009 (https:)
-FAIL Setting protocol with leading U+000A (https:) assert_equals: property expected "http:" but got "https:"
-FAIL Setting protocol with U+000A before inserted colon (https:) assert_equals: property expected "http:" but got "https:"
+PASS Setting protocol with leading U+000A (https:)
+PASS Setting protocol with U+000A before inserted colon (https:)
 PASS Setting username with leading U+000A (https:)
 PASS Setting username with middle U+000A (https:)
 PASS Setting username with trailing U+000A (https:)
@@ -77,8 +77,8 @@ PASS Setting search with trailing U+000A (https:)
 PASS Setting hash with leading U+000A (https:)
 PASS Setting hash with middle U+000A (https:)
 PASS Setting hash with trailing U+000A (https:)
-FAIL Setting protocol with leading U+000D (https:) assert_equals: property expected "http:" but got "https:"
-FAIL Setting protocol with U+000D before inserted colon (https:) assert_equals: property expected "http:" but got "https:"
+PASS Setting protocol with leading U+000D (https:)
+PASS Setting protocol with U+000D before inserted colon (https:)
 PASS Setting username with leading U+000D (https:)
 PASS Setting username with middle U+000D (https:)
 PASS Setting username with trailing U+000D (https:)
@@ -155,8 +155,8 @@ PASS Setting search with trailing U+0000 (wpt++:)
 PASS Setting hash with leading U+0000 (wpt++:)
 PASS Setting hash with middle U+0000 (wpt++:)
 PASS Setting hash with trailing U+0000 (wpt++:)
-FAIL Setting protocol with leading U+0009 (wpt++:) assert_equals: property expected "wpt--:" but got "wpt++:"
-FAIL Setting protocol with U+0009 before inserted colon (wpt++:) assert_equals: property expected "wpt--:" but got "wpt++:"
+PASS Setting protocol with leading U+0009 (wpt++:)
+PASS Setting protocol with U+0009 before inserted colon (wpt++:)
 PASS Setting username with leading U+0009 (wpt++:)
 PASS Setting username with middle U+0009 (wpt++:)
 PASS Setting username with trailing U+0009 (wpt++:)
@@ -181,8 +181,8 @@ PASS Setting search with trailing U+0009 (wpt++:)
 PASS Setting hash with leading U+0009 (wpt++:)
 PASS Setting hash with middle U+0009 (wpt++:)
 PASS Setting hash with trailing U+0009 (wpt++:)
-FAIL Setting protocol with leading U+000A (wpt++:) assert_equals: property expected "wpt--:" but got "wpt++:"
-FAIL Setting protocol with U+000A before inserted colon (wpt++:) assert_equals: property expected "wpt--:" but got "wpt++:"
+PASS Setting protocol with leading U+000A (wpt++:)
+PASS Setting protocol with U+000A before inserted colon (wpt++:)
 PASS Setting username with leading U+000A (wpt++:)
 PASS Setting username with middle U+000A (wpt++:)
 PASS Setting username with trailing U+000A (wpt++:)
@@ -207,8 +207,8 @@ PASS Setting search with trailing U+000A (wpt++:)
 PASS Setting hash with leading U+000A (wpt++:)
 PASS Setting hash with middle U+000A (wpt++:)
 PASS Setting hash with trailing U+000A (wpt++:)
-FAIL Setting protocol with leading U+000D (wpt++:) assert_equals: property expected "wpt--:" but got "wpt++:"
-FAIL Setting protocol with U+000D before inserted colon (wpt++:) assert_equals: property expected "wpt--:" but got "wpt++:"
+PASS Setting protocol with leading U+000D (wpt++:)
+PASS Setting protocol with U+000D before inserted colon (wpt++:)
 PASS Setting username with leading U+000D (wpt++:)
 PASS Setting username with middle U+000D (wpt++:)
 PASS Setting username with trailing U+000D (wpt++:)
diff --git a/LayoutTests/imported/w3c/web-platform-tests/url/url-setters-stripping.any.worker-expected.txt b/LayoutTests/imported/w3c/web-platform-tests/url/url-setters-stripping.any.worker-expected.txt
@@ -25,8 +25,8 @@ PASS Setting search with trailing U+0000 (https:)
 PASS Setting hash with leading U+0000 (https:)
 PASS Setting hash with middle U+0000 (https:)
 PASS Setting hash with trailing U+0000 (https:)
-FAIL Setting protocol with leading U+0009 (https:) assert_equals: property expected "http:" but got "https:"
-FAIL Setting protocol with U+0009 before inserted colon (https:) assert_equals: property expected "http:" but got "https:"
+PASS Setting protocol with leading U+0009 (https:)
+PASS Setting protocol with U+0009 before inserted colon (https:)
 PASS Setting username with leading U+0009 (https:)
 PASS Setting username with middle U+0009 (https:)
 PASS Setting username with trailing U+0009 (https:)
@@ -51,8 +51,8 @@ PASS Setting search with trailing U+0009 (https:)
 PASS Setting hash with leading U+0009 (https:)
 PASS Setting hash with middle U+0009 (https:)
 PASS Setting hash with trailing U+0009 (https:)
-FAIL Setting protocol with leading U+000A (https:) assert_equals: property expected "http:" but got "https:"
-FAIL Setting protocol with U+000A before inserted colon (https:) assert_equals: property expected "http:" but got "https:"
+PASS Setting protocol with leading U+000A (https:)
+PASS Setting protocol with U+000A before inserted colon (https:)
 PASS Setting username with leading U+000A (https:)
 PASS Setting username with middle U+000A (https:)
 PASS Setting username with trailing U+000A (https:)
@@ -77,8 +77,8 @@ PASS Setting search with trailing U+000A (https:)
 PASS Setting hash with leading U+000A (https:)
 PASS Setting hash with middle U+000A (https:)
 PASS Setting hash with trailing U+000A (https:)
-FAIL Setting protocol with leading U+000D (https:) assert_equals: property expected "http:" but got "https:"
-FAIL Setting protocol with U+000D before inserted colon (https:) assert_equals: property expected "http:" but got "https:"
+PASS Setting protocol with leading U+000D (https:)
+PASS Setting protocol with U+000D before inserted colon (https:)
 PASS Setting username with leading U+000D (https:)
 PASS Setting username with middle U+000D (https:)
 PASS Setting username with trailing U+000D (https:)
@@ -155,8 +155,8 @@ PASS Setting search with trailing U+0000 (wpt++:)
 PASS Setting hash with leading U+0000 (wpt++:)
 PASS Setting hash with middle U+0000 (wpt++:)
 PASS Setting hash with trailing U+0000 (wpt++:)
-FAIL Setting protocol with leading U+0009 (wpt++:) assert_equals: property expected "wpt--:" but got "wpt++:"
-FAIL Setting protocol with U+0009 before inserted colon (wpt++:) assert_equals: property expected "wpt--:" but got "wpt++:"
+PASS Setting protocol with leading U+0009 (wpt++:)
+PASS Setting protocol with U+0009 before inserted colon (wpt++:)
 PASS Setting username with leading U+0009 (wpt++:)
 PASS Setting username with middle U+0009 (wpt++:)
 PASS Setting username with trailing U+0009 (wpt++:)
@@ -181,8 +181,8 @@ PASS Setting search with trailing U+0009 (wpt++:)
 PASS Setting hash with leading U+0009 (wpt++:)
 PASS Setting hash with middle U+0009 (wpt++:)
 PASS Setting hash with trailing U+0009 (wpt++:)
-FAIL Setting protocol with leading U+000A (wpt++:) assert_equals: property expected "wpt--:" but got "wpt++:"
-FAIL Setting protocol with U+000A before inserted colon (wpt++:) assert_equals: property expected "wpt--:" but got "wpt++:"
+PASS Setting protocol with leading U+000A (wpt++:)
+PASS Setting protocol with U+000A before inserted colon (wpt++:)
 PASS Setting username with leading U+000A (wpt++:)
 PASS Setting username with middle U+000A (wpt++:)
 PASS Setting username with trailing U+000A (wpt++:)
@@ -207,8 +207,8 @@ PASS Setting search with trailing U+000A (wpt++:)
 PASS Setting hash with leading U+000A (wpt++:)
 PASS Setting hash with middle U+000A (wpt++:)
 PASS Setting hash with trailing U+000A (wpt++:)
-FAIL Setting protocol with leading U+000D (wpt++:) assert_equals: property expected "wpt--:" but got "wpt++:"
-FAIL Setting protocol with U+000D before inserted colon (wpt++:) assert_equals: property expected "wpt--:" but got "wpt++:"
+PASS Setting protocol with leading U+000D (wpt++:)
+PASS Setting protocol with U+000D before inserted colon (wpt++:)
 PASS Setting username with leading U+000D (wpt++:)
 PASS Setting username with middle U+000D (wpt++:)
 PASS Setting username with trailing U+000D (wpt++:)
diff --git a/Source/WTF/wtf/URLParser.cpp b/Source/WTF/wtf/URLParser.cpp
