[registerProtocolHandler] Only substitute the first "%s" placeholder

The spec says that "When the user agent uses this handler, it must replace the first occurrence of
the exact literal string "%s" in the URL argument".

- Spec: https://html.spec.whatwg.org/multipage/system-state.html#custom-handlers

So, only the first %s can be changed to the given URL.

For example, let's assume this scenario,
  1. navigator.registerProtocolHandler("test", 'http://example.com/%s/url=%s', 'title');"
  2. <a href="test:duplicated_placeholders">this</a>

According to the specification, destination URL should be
  "http://example.com/test%3Aduplicated_placeholders/url=%s".

But, current Chrome implementation replaces all placeholders with the given custom url as below,
  "http://example.com/test%3Aduplicated_placeholders/url=test%3Aduplicated_placeholders"

Firefox also substitutes only first placeholder when url contains multiple placeholders.

Bug: 791912
Change-Id: Ic3d439c68ac35d776afa6b6907ecdc0da774b08e
Reviewed-on: https://chromium-review.googlesource.com/808086
Commit-Queue: Gyuyoung Kim <gyuyoung.kim@lge.com>
Reviewed-by: Matt Giuca <mgiuca@chromium.org>
Reviewed-by: Ben Wells <benwells@chromium.org>
Cr-Commit-Position: refs/heads/master@{#522360}

chrome/browser/custom_handlers/protocol_handler_registry_unittest.cc

@@ -991,3 +991,16 @@ TEST_F(ProtocolHandlerRegistryTest, TestPrefPolicyOverlapIgnore) {
   ASSERT_EQ(InPrefIgnoredHandlerCount(), 1);
   ASSERT_EQ(InMemoryIgnoredHandlerCount(), 4);
 }
+
+TEST_F(ProtocolHandlerRegistryTest, TestMultiplePlaceholders) {
+  ProtocolHandler ph =
+      CreateProtocolHandler("test", GURL("http://example.com/%s/url=%s"));
+  registry()->OnAcceptRegisterProtocolHandler(ph);
+
+  GURL translated_url = ph.TranslateUrl(GURL("test:duplicated_placeholders"));
+
+  // When URL contains multiple placeholders, only the first placeholder should
+  // be changed to the given URL.
+  ASSERT_EQ(translated_url,
+            GURL("http://example.com/test%3Aduplicated_placeholders/url=%s"));
+}

chrome/common/custom_handlers/protocol_handler.cc

@@ -54,7 +54,8 @@ ProtocolHandler ProtocolHandler::CreateProtocolHandler(
 
 GURL ProtocolHandler::TranslateUrl(const GURL& url) const {
   std::string translatedUrlSpec(url_.spec());
-  base::ReplaceSubstringsAfterOffset(&translatedUrlSpec, 0, "%s",
+  base::ReplaceFirstSubstringAfterOffset(
+      &translatedUrlSpec, 0, "%s",
       net::EscapeQueryParamValue(url.spec(), true));
   return GURL(translatedUrlSpec);
 }