Disallow '+', '-', '.' and digits as the first character of a scheme.

This CL recognizes that https://url.spec.whatwg.org/#scheme-start-state
only allows "ASCII alpha" as the first letter of a URL scheme.  Thanks
to this change, "1:..." is not treated as an absolute URL.

Fixed: 530123
Change-Id: I5ebadaebab18aebb5903968d14f39f092057f3cd
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2080075Reviewed-by: Mike West <mkwst@chromium.org>
Commit-Queue: Łukasz Anforowicz <lukasza@chromium.org>
Cr-Commit-Position: refs/heads/master@{#746191}

third_party/blink/web_tests/external/wpt/url/resources/urltestdata.json

@@ -6682,5 +6682,50 @@
     "pathname": "/test",
     "search": "?a",
     "hash": "#bc"
+  },
+  "First scheme char - not allowed: https://github.com/whatwg/url/issues/464",
+  {
+    "input": "10.0.0.7:8080/foo.html",
+    "base": "file:///some/dir/bar.html",
+    "href": "file:///some/dir/10.0.0.7:8080/foo.html",
+    "protocol": "file:",
+    "username": "",
+    "password": "",
+    "host": "",
+    "hostname": "",
+    "port": "",
+    "pathname": "/some/dir/10.0.0.7:8080/foo.html",
+    "search": "",
+    "hash": ""
+  },
+  "Subsequent scheme chars - not allowed",
+  {
+    "input": "a!@$*=/foo.html",
+    "base": "file:///some/dir/bar.html",
+    "href": "file:///some/dir/a!@$*=/foo.html",
+    "protocol": "file:",
+    "username": "",
+    "password": "",
+    "host": "",
+    "hostname": "",
+    "port": "",
+    "pathname": "/some/dir/a!@$*=/foo.html",
+    "search": "",
+    "hash": ""
+  },
+  "First and subsequent scheme chars - allowed",
+  {
+    "input": "a1234567890-+.:foo/bar",
+    "base": "http://example.com/dir/file",
+    "href": "a1234567890-+.:foo/bar",
+    "protocol": "a1234567890-+.:",
+    "username": "",
+    "password": "",
+    "host": "",
+    "hostname": "",
+    "port": "",
+    "pathname": "foo/bar",
+    "search": "",
+    "hash": ""
   }
 ]

third_party/blink/web_tests/platform/linux/external/wpt/url/a-element-expected.txt

 This is a testharness.js-based test.
-Found 517 tests; 332 PASS, 185 FAIL, 0 TIMEOUT, 0 NOTRUN.
+Found 520 tests; 335 PASS, 185 FAIL, 0 TIMEOUT, 0 NOTRUN.
 PASS Loading data…
 PASS Parsing: <http://example	.
 org> against <http://example.org/foo/bar>
@@ -527,5 +527,8 @@ FAIL Parsing: <test-a-colon-slash-slash.html> against <a://> assert_equals: href
 PASS Parsing: <test-a-colon-slash-b.html> against <a:/b>
 FAIL Parsing: <test-a-colon-slash-slash-b.html> against <a://b> assert_equals: href expected "a://b/test-a-colon-slash-slash-b.html" but got "a://b"
 PASS Parsing: <http://example.org/test?a#b\0c> against <about:blank>
+PASS Parsing: <10.0.0.7:8080/foo.html> against <file:///some/dir/bar.html>
+PASS Parsing: <a!@$*=/foo.html> against <file:///some/dir/bar.html>
+PASS Parsing: <a1234567890-+.:foo/bar> against <http://example.com/dir/file>
 Harness: the test ran to completion.
 

third_party/blink/web_tests/platform/linux/external/wpt/url/a-element-xhtml-expected.txt

 This is a testharness.js-based test.
-Found 517 tests; 332 PASS, 185 FAIL, 0 TIMEOUT, 0 NOTRUN.
+Found 520 tests; 335 PASS, 185 FAIL, 0 TIMEOUT, 0 NOTRUN.
 PASS Loading data…
 PASS Parsing: <http://example	.
 org> against <http://example.org/foo/bar>
@@ -527,5 +527,8 @@ FAIL Parsing: <test-a-colon-slash-slash.html> against <a://> assert_equals: href
 PASS Parsing: <test-a-colon-slash-b.html> against <a:/b>
 FAIL Parsing: <test-a-colon-slash-slash-b.html> against <a://b> assert_equals: href expected "a://b/test-a-colon-slash-slash-b.html" but got "a://b"
 PASS Parsing: <http://example.org/test?a#b\0c> against <about:blank>
+PASS Parsing: <10.0.0.7:8080/foo.html> against <file:///some/dir/bar.html>
+PASS Parsing: <a!@$*=/foo.html> against <file:///some/dir/bar.html>
+PASS Parsing: <a1234567890-+.:foo/bar> against <http://example.com/dir/file>
 Harness: the test ran to completion.
 

third_party/blink/web_tests/platform/linux/external/wpt/url/url-constructor-expected.txt

 This is a testharness.js-based test.
-Found 517 tests; 398 PASS, 119 FAIL, 0 TIMEOUT, 0 NOTRUN.
+Found 520 tests; 401 PASS, 119 FAIL, 0 TIMEOUT, 0 NOTRUN.
 PASS Loading data…
 PASS Parsing: <http://example	.
 org> against <http://example.org/foo/bar>
@@ -569,5 +569,8 @@ FAIL Parsing: <test-a-colon-slash-slash.html> against <a://> Failed to construct
 PASS Parsing: <test-a-colon-slash-b.html> against <a:/b>
 FAIL Parsing: <test-a-colon-slash-slash-b.html> against <a://b> Failed to construct 'URL': Invalid URL
 PASS Parsing: <http://example.org/test?a#b\0c> against <about:blank>
+PASS Parsing: <10.0.0.7:8080/foo.html> against <file:///some/dir/bar.html>
+PASS Parsing: <a!@$*=/foo.html> against <file:///some/dir/bar.html>
+PASS Parsing: <a1234567890-+.:foo/bar> against <http://example.com/dir/file>
 Harness: the test ran to completion.
 

third_party/blink/web_tests/platform/mac/external/wpt/url/a-element-expected.txt

 This is a testharness.js-based test.
-Found 517 tests; 332 PASS, 185 FAIL, 0 TIMEOUT, 0 NOTRUN.
+Found 520 tests; 335 PASS, 185 FAIL, 0 TIMEOUT, 0 NOTRUN.
 PASS Loading data…
 PASS Parsing: <http://example	.
 org> against <http://example.org/foo/bar>
@@ -527,5 +527,8 @@ FAIL Parsing: <test-a-colon-slash-slash.html> against <a://> assert_equals: href
 PASS Parsing: <test-a-colon-slash-b.html> against <a:/b>
 FAIL Parsing: <test-a-colon-slash-slash-b.html> against <a://b> assert_equals: href expected "a://b/test-a-colon-slash-slash-b.html" but got "a://b"
 PASS Parsing: <http://example.org/test?a#b\0c> against <about:blank>
+PASS Parsing: <10.0.0.7:8080/foo.html> against <file:///some/dir/bar.html>
+PASS Parsing: <a!@$*=/foo.html> against <file:///some/dir/bar.html>
+PASS Parsing: <a1234567890-+.:foo/bar> against <http://example.com/dir/file>
 Harness: the test ran to completion.
 

third_party/blink/web_tests/platform/mac/external/wpt/url/a-element-xhtml-expected.txt

 This is a testharness.js-based test.
-Found 517 tests; 332 PASS, 185 FAIL, 0 TIMEOUT, 0 NOTRUN.
+Found 520 tests; 335 PASS, 185 FAIL, 0 TIMEOUT, 0 NOTRUN.
 PASS Loading data…
 PASS Parsing: <http://example	.
 org> against <http://example.org/foo/bar>
@@ -527,5 +527,8 @@ FAIL Parsing: <test-a-colon-slash-slash.html> against <a://> assert_equals: href
 PASS Parsing: <test-a-colon-slash-b.html> against <a:/b>
 FAIL Parsing: <test-a-colon-slash-slash-b.html> against <a://b> assert_equals: href expected "a://b/test-a-colon-slash-slash-b.html" but got "a://b"
 PASS Parsing: <http://example.org/test?a#b\0c> against <about:blank>
+PASS Parsing: <10.0.0.7:8080/foo.html> against <file:///some/dir/bar.html>
+PASS Parsing: <a!@$*=/foo.html> against <file:///some/dir/bar.html>
+PASS Parsing: <a1234567890-+.:foo/bar> against <http://example.com/dir/file>
 Harness: the test ran to completion.
 

third_party/blink/web_tests/platform/mac/external/wpt/url/url-constructor-expected.txt

 This is a testharness.js-based test.
-Found 517 tests; 398 PASS, 119 FAIL, 0 TIMEOUT, 0 NOTRUN.
+Found 520 tests; 401 PASS, 119 FAIL, 0 TIMEOUT, 0 NOTRUN.
 PASS Loading data…
 PASS Parsing: <http://example	.
 org> against <http://example.org/foo/bar>
@@ -569,5 +569,8 @@ FAIL Parsing: <test-a-colon-slash-slash.html> against <a://> Failed to construct
 PASS Parsing: <test-a-colon-slash-b.html> against <a:/b>
 FAIL Parsing: <test-a-colon-slash-slash-b.html> against <a://b> Failed to construct 'URL': Invalid URL
 PASS Parsing: <http://example.org/test?a#b\0c> against <about:blank>
+PASS Parsing: <10.0.0.7:8080/foo.html> against <file:///some/dir/bar.html>
+PASS Parsing: <a!@$*=/foo.html> against <file:///some/dir/bar.html>
+PASS Parsing: <a1234567890-+.:foo/bar> against <http://example.com/dir/file>
 Harness: the test ran to completion.
 

third_party/blink/web_tests/platform/win/external/wpt/url/a-element-expected.txt

 This is a testharness.js-based test.
-Found 517 tests; 328 PASS, 189 FAIL, 0 TIMEOUT, 0 NOTRUN.
+Found 520 tests; 331 PASS, 189 FAIL, 0 TIMEOUT, 0 NOTRUN.
 PASS Loading data…
 PASS Parsing: <http://example	.
 org> against <http://example.org/foo/bar>
@@ -527,5 +527,8 @@ FAIL Parsing: <test-a-colon-slash-slash.html> against <a://> assert_equals: href
 FAIL Parsing: <test-a-colon-slash-b.html> against <a:/b> assert_equals: href expected "a:/test-a-colon-slash-b.html" but got "file:///A:/test-a-colon-slash-b.html"
 FAIL Parsing: <test-a-colon-slash-slash-b.html> against <a://b> assert_equals: href expected "a://b/test-a-colon-slash-slash-b.html" but got "file:///A://test-a-colon-slash-slash-b.html"
 PASS Parsing: <http://example.org/test?a#b\0c> against <about:blank>
+PASS Parsing: <10.0.0.7:8080/foo.html> against <file:///some/dir/bar.html>
+PASS Parsing: <a!@$*=/foo.html> against <file:///some/dir/bar.html>
+PASS Parsing: <a1234567890-+.:foo/bar> against <http://example.com/dir/file>
 Harness: the test ran to completion.
 

third_party/blink/web_tests/platform/win/external/wpt/url/a-element-xhtml-expected.txt

 This is a testharness.js-based test.
-Found 517 tests; 328 PASS, 189 FAIL, 0 TIMEOUT, 0 NOTRUN.
+Found 520 tests; 331 PASS, 189 FAIL, 0 TIMEOUT, 0 NOTRUN.
 PASS Loading data…
 PASS Parsing: <http://example	.
 org> against <http://example.org/foo/bar>
@@ -527,5 +527,8 @@ FAIL Parsing: <test-a-colon-slash-slash.html> against <a://> assert_equals: href
 FAIL Parsing: <test-a-colon-slash-b.html> against <a:/b> assert_equals: href expected "a:/test-a-colon-slash-b.html" but got "file:///A:/test-a-colon-slash-b.html"
 FAIL Parsing: <test-a-colon-slash-slash-b.html> against <a://b> assert_equals: href expected "a://b/test-a-colon-slash-slash-b.html" but got "file:///A://test-a-colon-slash-slash-b.html"
 PASS Parsing: <http://example.org/test?a#b\0c> against <about:blank>
+PASS Parsing: <10.0.0.7:8080/foo.html> against <file:///some/dir/bar.html>
+PASS Parsing: <a!@$*=/foo.html> against <file:///some/dir/bar.html>
+PASS Parsing: <a1234567890-+.:foo/bar> against <http://example.com/dir/file>
 Harness: the test ran to completion.
 

third_party/blink/web_tests/platform/win/external/wpt/url/url-constructor-expected.txt

 This is a testharness.js-based test.
-Found 517 tests; 392 PASS, 125 FAIL, 0 TIMEOUT, 0 NOTRUN.
+Found 520 tests; 395 PASS, 125 FAIL, 0 TIMEOUT, 0 NOTRUN.
 PASS Loading data…
 PASS Parsing: <http://example	.
 org> against <http://example.org/foo/bar>
@@ -573,5 +573,8 @@ FAIL Parsing: <test-a-colon-slash-slash.html> against <a://> assert_equals: href
 FAIL Parsing: <test-a-colon-slash-b.html> against <a:/b> assert_equals: href expected "a:/test-a-colon-slash-b.html" but got "file:///A:/test-a-colon-slash-b.html"
 FAIL Parsing: <test-a-colon-slash-slash-b.html> against <a://b> assert_equals: href expected "a://b/test-a-colon-slash-slash-b.html" but got "file:///A://test-a-colon-slash-slash-b.html"
 PASS Parsing: <http://example.org/test?a#b\0c> against <about:blank>
+PASS Parsing: <10.0.0.7:8080/foo.html> against <file:///some/dir/bar.html>
+PASS Parsing: <a!@$*=/foo.html> against <file:///some/dir/bar.html>
+PASS Parsing: <a1234567890-+.:foo/bar> against <http://example.com/dir/file>
 Harness: the test ran to completion.
 

url/gurl_unittest.cc

@@ -289,21 +289,42 @@ TEST(GURLTest, Resolve) {
     bool expected_valid;
     const char* expected;
   } resolve_cases[] = {
-    {"http://www.google.com/", "foo.html", true, "http://www.google.com/foo.html"},
-    {"http://www.google.com/foo/", "bar", true, "http://www.google.com/foo/bar"},
-    {"http://www.google.com/foo/", "/bar", true, "http://www.google.com/bar"},
-    {"http://www.google.com/foo", "bar", true, "http://www.google.com/bar"},
-    {"http://www.google.com/", "http://images.google.com/foo.html", true, "http://images.google.com/foo.html"},
-    {"http://www.google.com/", "http://images.\tgoogle.\ncom/\rfoo.html", true, "http://images.google.com/foo.html"},
-    {"http://www.google.com/blah/bloo?c#d", "../../../hello/./world.html?a#b", true, "http://www.google.com/hello/world.html?a#b"},
-    {"http://www.google.com/foo#bar", "#com", true, "http://www.google.com/foo#com"},
-    {"http://www.google.com/", "Https:images.google.com", true, "https://images.google.com/"},
+      {"http://www.google.com/", "foo.html", true,
+       "http://www.google.com/foo.html"},
+      {"http://www.google.com/foo/", "bar", true,
+       "http://www.google.com/foo/bar"},
+      {"http://www.google.com/foo/", "/bar", true, "http://www.google.com/bar"},
+      {"http://www.google.com/foo", "bar", true, "http://www.google.com/bar"},
+      {"http://www.google.com/", "http://images.google.com/foo.html", true,
+       "http://images.google.com/foo.html"},
+      {"http://www.google.com/", "http://images.\tgoogle.\ncom/\rfoo.html",
+       true, "http://images.google.com/foo.html"},
+      {"http://www.google.com/blah/bloo?c#d", "../../../hello/./world.html?a#b",
+       true, "http://www.google.com/hello/world.html?a#b"},
+      {"http://www.google.com/foo#bar", "#com", true,
+       "http://www.google.com/foo#com"},
+      {"http://www.google.com/", "Https:images.google.com", true,
+       "https://images.google.com/"},
       // A non-standard base can be replaced with a standard absolute URL.
-    {"data:blahblah", "http://google.com/", true, "http://google.com/"},
-    {"data:blahblah", "http:google.com", true, "http://google.com/"},
+      {"data:blahblah", "http://google.com/", true, "http://google.com/"},
+      {"data:blahblah", "http:google.com", true, "http://google.com/"},
       // Filesystem URLs have different paths to test.
-    {"filesystem:http://www.google.com/type/", "foo.html", true, "filesystem:http://www.google.com/type/foo.html"},
-    {"filesystem:http://www.google.com/type/", "../foo.html", true, "filesystem:http://www.google.com/type/foo.html"},
+      {"filesystem:http://www.google.com/type/", "foo.html", true,
+       "filesystem:http://www.google.com/type/foo.html"},
+      {"filesystem:http://www.google.com/type/", "../foo.html", true,
+       "filesystem:http://www.google.com/type/foo.html"},
+      // https://crbug.com/530123 - scheme validation (e.g. are "10.0.0.7:"
+      // or "x1:" valid schemes) when deciding if |relative| is an absolute url.
+      {"file:///some/dir/ip-relative.html", "10.0.0.7:8080/foo.html", true,
+       "file:///some/dir/10.0.0.7:8080/foo.html"},
+      {"file:///some/dir/", "1://host", true, "file:///some/dir/1://host"},
+      {"file:///some/dir/", "x1://host", true, "x1://host"},
+      {"file:///some/dir/", "X1://host", true, "x1://host"},
+      {"file:///some/dir/", "x.://host", true, "x.://host"},
+      {"file:///some/dir/", "x+://host", true, "x+://host"},
+      {"file:///some/dir/", "x-://host", true, "x-://host"},
+      {"file:///some/dir/", "x!://host", true, "file:///some/dir/x!://host"},
+      {"file:///some/dir/", "://host", true, "file:///some/dir/://host"},
   };
 
   for (size_t i = 0; i < base::size(resolve_cases); i++) {

url/url_canon_relative.cc

@@ -7,6 +7,7 @@
 #include <algorithm>
 
 #include "base/logging.h"
+#include "base/strings/string_util.h"
 #include "url/url_canon.h"
 #include "url/url_canon_internal.h"
 #include "url/url_constants.h"
@@ -62,6 +63,39 @@ bool DoesBeginSlashWindowsDriveSpec(const CHAR* spec, int start_offset,
 
 #endif  // WIN32
 
+template <typename CHAR>
+bool IsValidScheme(const CHAR* url, const Component& scheme) {
+  // Caller should ensure that the |scheme| is not empty.
+  DCHECK_NE(0, scheme.len);
+
+  // From https://url.spec.whatwg.org/#scheme-start-state:
+  //   scheme start state:
+  //     1. If c is an ASCII alpha, append c, lowercased, to buffer, and set
+  //        state to scheme state.
+  //     2. Otherwise, if state override is not given, set state to no scheme
+  //        state, and decrease pointer by one.
+  //     3. Otherwise, validation error, return failure.
+  // Note that both step 2 and step 3 mean that the scheme was not valid.
+  if (!base::IsAsciiAlpha(url[scheme.begin]))
+    return false;
+
+  // From https://url.spec.whatwg.org/#scheme-state:
+  //   scheme state:
+  //     1. If c is an ASCII alphanumeric, U+002B (+), U+002D (-), or U+002E
+  //        (.), append c, lowercased, to buffer.
+  //     2. Otherwise, if c is U+003A (:), then [...]
+  //
+  // We begin at |scheme.begin + 1|, because the character at |scheme.begin| has
+  // already been checked by base::IsAsciiAlpha above.
+  int scheme_end = scheme.end();
+  for (int i = scheme.begin + 1; i < scheme_end; i++) {
+    if (!CanonicalSchemeChar(url[i]))
+      return false;
+  }
+
+  return true;
+}
+
 // See IsRelativeURL in the header file for usage.
 template<typename CHAR>
 bool DoIsRelativeURL(const char* base,
@@ -126,17 +160,14 @@ bool DoIsRelativeURL(const char* base,
   }
 
   // If the scheme isn't valid, then it's relative.
-  int scheme_end = scheme.end();
-  for (int i = scheme.begin; i < scheme_end; i++) {
-    if (!CanonicalSchemeChar(url[i])) {
-      if (!is_base_hierarchical) {
-        // Don't allow relative URLs if the base scheme doesn't support it.
-        return false;
-      }
-      *relative_component = MakeRange(begin, url_len);
-      *is_relative = true;
-      return true;
+  if (!IsValidScheme(url, scheme)) {
+    if (!is_base_hierarchical) {
+      // Don't allow relative URLs if the base scheme doesn't support it.
+      return false;
     }
+    *relative_component = MakeRange(begin, url_len);
+    *is_relative = true;
+    return true;
   }
 
   // If the scheme is not the same, then we can't count it as relative.