Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit af0b4466 authored by Paul Jensen's avatar Paul Jensen Committed by Android (Google) Code Review
Browse files

Merge "Don't pass URL path and username/password to PAC scripts" into klp-dev

parents 7c9f2b8a 08ec0e53
Loading
Loading
Loading
Loading
+9 −0
Original line number Diff line number Diff line
@@ -31,6 +31,7 @@ import java.net.Proxy.Type;
import java.net.ProxySelector;
import java.net.SocketAddress;
import java.net.URI;
import java.net.URISyntaxException;
import java.util.List;

/**
@@ -65,7 +66,15 @@ public class PacProxySelector extends ProxySelector {
        String response = null;
        String urlString;
        try {
            // Strip path and username/password from URI so it's not visible to PAC script. The
            // path often contains credentials the app does not want exposed to a potentially
            // malicious PAC script.
            if (!"http".equalsIgnoreCase(uri.getScheme())) {
                uri = new URI(uri.getScheme(), null, uri.getHost(), uri.getPort(), "/", null, null);
            }
            urlString = uri.toURL().toString();
        } catch (URISyntaxException e) {
            urlString = uri.getHost();
        } catch (MalformedURLException e) {
            urlString = uri.getHost();
        }