commit 3187fae1b0fcee628a0b5fb39f65a4fe33f93869
author Tommy Li <tommycli@chromium.org> Thu Nov 14 20:04:22 2019
committer Commit Bot <commit-bot@chromium.org> Thu Nov 14 20:04:22 2019
tree 8f7418674774f9a5a2e50f3eb641c4bfde9197fb
parent a5315dfe44f94abf96dac68ce57c415d1b2f3452

[net] Fix spoof attack on file:// URLs on POSIX systems

For file:// URLs on POSIX, we currently discard the host portion of the
URL, and treat all file:// URLs as local. On Windows, we use the host
portion as the SAMBA share, so this bug is inapplicable to Windows.

This allows us to have URLs like:
file://accounts.google.com/home/tommycli/Downloads/evil.html

This is a low severity bug, since it's quite hard to exploit, but we
should fix it anyways.

RFC 8089 doesn't actually prohibit our previous behavior, but it does
frown on it.

This CL *could* break file:// links that relied on the old behavior,
but those file:// links should probably be rightfully-broken, since
they didn't work on Windows anyways.

Bug: 881675
Change-Id: Ie9c90ac6285b698089205e73f46f0af13867e806
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1907071
Reviewed-by: Adam Langley <agl@chromium.org>
Reviewed-by: Min Qin <qinmin@chromium.org>
Reviewed-by: Mohammad Refaat <mrefaat@chromium.org>
Commit-Queue: Tommy Li <tommycli@chromium.org>
Cr-Commit-Position: refs/heads/master@{#715373}