Commit d674b09a authored Feb 27, 2018 by Nate Fischer

WebView: relax URLUtil#isFileUrl()

This relaxes URLUtil#isFileUrl() to accept a prefix of "file:" instead
of requiring "file://". Chromium treats "file:path" as if the user had
typed "file:///path". An app may incorrectly believe it's safe to load
anything that URLUtil#isFileUrl() rejects, intending to refuse all URLs
which point to the file system.

Bug: 72848579
Test: cts-tradefed run cts -m CtsWebkitTestCases -t android.webkit.cts.URLUtilTest#testIsFileUrl
Change-Id: I7b3bba961523d4bdda6169a0f50fe7f1d1579e38

parent e7e42ceb

core/java/android/webkit/URLUtil.java

+1 −1

Original line number	Diff line number	Diff line
		@@ -39,7 +39,7 @@ public final class URLUtil {
		// "file:///android_res/drawable/bar.png". Use "drawable" to refer to
		// "drawable-hdpi" directory as well.
		static final String RESOURCE_BASE = "file:///android_res/";
		static final String FILE_BASE = "file://";
		static final String FILE_BASE = "file:";
		static final String PROXY_BASE = "file:///cookieless_proxy/";
		static final String CONTENT_BASE = "content:";