Commit message: None
CVE: CVE-2011-2822
CWE: CWE-20
Vulnerability description: Google Chrome before 13.0.782.215 on Windows does not properly parse URLs located on the command line, which has unspecified impact and attack vectors.

Project: Chrome

static std::string FixupHomedir(const std::string& text) {
  DCHECK(text.length() > 0 && text[0] == '~');

  if (text.length() == 1 || text[1] == '/') {
    const char* home = getenv(base::env_vars::kHome);
    if (URLFixerUpper::home_directory_override)
      home = URLFixerUpper::home_directory_override;
    if (!home)
      return text;
    return home + text.substr(1);
  }


#if defined(OS_MACOSX)
  static const char kHome[] = "/Users/";
#else
  static const char kHome[] = "/home/";
#endif
  return kHome + text.substr(1);
}

Project: Chrome

static void FixupHost(const std::string& text,
                      const url_parse::Component& part,
                      bool has_scheme,
                      const std::string& desired_tld,
                      std::string* url) {
  if (!part.is_valid())
    return;

  std::string domain(text, part.begin, part.len);
  const size_t first_nondot(domain.find_first_not_of('.'));
  if (first_nondot != std::string::npos) {
    domain.erase(0, first_nondot);
    size_t last_nondot(domain.find_last_not_of('.'));
    DCHECK(last_nondot != std::string::npos);
    last_nondot += 2;  // Point at second period in ending string
    if (last_nondot < domain.length())
      domain.erase(last_nondot);
  }

  AddDesiredTLD(desired_tld, &domain);

  url->append(domain);
}

Project: Chrome

static inline void FixupPassword(const std::string& text,
                                 const url_parse::Component& part,
                                 std::string* url) {
  if (!part.is_valid())
    return;

  url->append(":");
  url->append(text, part.begin, part.len);
}

Project: Chrome

static std::string FixupPath(const std::string& text) {
  DCHECK(!text.empty());

  FilePath::StringType filename;
#if defined(OS_WIN)
  FilePath input_path(UTF8ToWide(text));
  PrepareStringForFileOps(input_path, &filename);

  if (filename.length() > 1 && filename[1] == '|')
    filename[1] = ':';
#elif defined(OS_POSIX)
  FilePath input_path(text);
  PrepareStringForFileOps(input_path, &filename);
  if (filename.length() > 0 && filename[0] == '~')
    filename = FixupHomedir(filename);
#endif

  GURL file_url = net::FilePathToFileURL(FilePath(filename));
  if (file_url.is_valid()) {
    return UTF16ToUTF8(net::FormatUrl(file_url, std::string(),
        net::kFormatUrlOmitUsernamePassword, UnescapeRule::NORMAL, NULL,
        NULL, NULL));
  }

  return text;
}

Project: Chrome

static inline void FixupPath(const std::string& text,
                             const url_parse::Component& part,
                             std::string* url) {
  if (!part.is_valid() || part.len == 0) {
    url->append("/");
    return;
  }

  url->append(text, part.begin, part.len);
}

Project: Chrome

static void FixupPort(const std::string& text,
                      const url_parse::Component& part,
                      std::string* url) {
  if (!part.is_valid())
    return;

  url->append(":");
  url->append(text, part.begin, part.len);
}

Project: Chrome

static inline void FixupQuery(const std::string& text,
                              const url_parse::Component& part,
                              std::string* url) {
  if (!part.is_valid())
    return;

  url->append("?");
  url->append(text, part.begin, part.len);
}

Project: Chrome

static inline void FixupRef(const std::string& text,
                            const url_parse::Component& part,
                            std::string* url) {
  if (!part.is_valid())
    return;

  url->append("#");
  url->append(text, part.begin, part.len);
}

Project: Chrome

GURL URLFixerUpper::FixupURL(const std::string& text,
                             const std::string& desired_tld) {
  std::string trimmed;
  TrimWhitespaceUTF8(text, TRIM_ALL, &trimmed);
  if (trimmed.empty())
    return GURL();  // Nothing here.

  url_parse::Parsed parts;
  std::string scheme(SegmentURL(trimmed, &parts));

  if (scheme == chrome::kViewSourceScheme) {
    std::string view_source(chrome::kViewSourceScheme + std::string(":"));
    if (!StartsWithASCII(text, view_source + view_source, false)) {
      return GURL(chrome::kViewSourceScheme + std::string(":") +
          FixupURL(trimmed.substr(scheme.length() + 1),
                   desired_tld).possibly_invalid_spec());
    }
  }

  if (scheme == chrome::kFileScheme)
    return GURL(parts.scheme.is_valid() ? text : FixupPath(text));

  bool chrome_url = !LowerCaseEqualsASCII(trimmed, chrome::kAboutBlankURL) &&
      ((scheme == chrome::kAboutScheme) || (scheme == chrome::kChromeUIScheme));

  if (chrome_url || url_util::IsStandard(scheme.c_str(),
          url_parse::Component(0, static_cast<int>(scheme.length())))) {
    std::string url(chrome_url ? chrome::kChromeUIScheme : scheme);
    url.append(chrome::kStandardSchemeSeparator);

    if (parts.username.is_valid()) {
      FixupUsername(trimmed, parts.username, &url);
      FixupPassword(trimmed, parts.password, &url);
      url.append("@");
    }

    FixupHost(trimmed, parts.host, parts.scheme.is_valid(), desired_tld, &url);
    if (chrome_url && !parts.host.is_valid())
      url.append(chrome::kChromeUIDefaultHost);
    FixupPort(trimmed, parts.port, &url);
    FixupPath(trimmed, parts.path, &url);
    FixupQuery(trimmed, parts.query, &url);
    FixupRef(trimmed, parts.ref, &url);

    return GURL(url);
  }

  if (!parts.scheme.is_valid()) {
    std::string fixed_scheme(scheme);
    fixed_scheme.append(chrome::kStandardSchemeSeparator);
    trimmed.insert(0, fixed_scheme);
  }

  return GURL(trimmed);
}

Project: Chrome

static inline void FixupUsername(const std::string& text,
                                 const url_parse::Component& part,
                                 std::string* url) {
  if (!part.is_valid())
    return;

  url->append(text, part.begin, part.len);
}

Project: Chrome

static bool GetValidScheme(const std::string &text,
                           url_parse::Component* scheme_component,
                           std::string* canon_scheme) {
  if (!url_parse::ExtractScheme(text.data(), static_cast<int>(text.length()),
                                scheme_component))
    return false;

  url_canon::StdStringCanonOutput canon_scheme_output(canon_scheme);
  url_parse::Component canon_scheme_component;
  if (!url_canon::CanonicalizeScheme(text.data(), *scheme_component,
                                     &canon_scheme_output,
                                     &canon_scheme_component))
    return false;

  DCHECK_EQ(0, canon_scheme_component.begin);
  canon_scheme->erase(canon_scheme_component.len);

  if (canon_scheme->find('.') != std::string::npos)
    return false;

  if (HasPort(text, *scheme_component))
    return false;

  return true;
}

Project: Chrome

static bool HasPort(const std::string& original_text,
                    const url_parse::Component& scheme_component) {
  size_t port_start = scheme_component.end() + 1;
  size_t port_end = port_start;
  while ((port_end < original_text.length()) &&
         !url_parse::IsAuthorityTerminator(original_text[port_end]))
    ++port_end;
  if (port_end == port_start)
    return false;

  for (size_t i = port_start; i < port_end; ++i) {
    if (!IsAsciiDigit(original_text[i]))
      return false;
  }

  return true;
}

Project: Chrome

void URLFixerUpper::OffsetComponent(int offset, url_parse::Component* part) {
  DCHECK(part);

  if (part->is_valid()) {
    part->begin += offset;

    if (part->begin < 0)
      part->reset();
  }
}

Project: Chrome

static void PrepareStringForFileOps(const FilePath& text,
                                    FilePath::StringType* output) {
#if defined(OS_WIN)
  TrimWhitespace(text.value(), TRIM_ALL, output);
  replace(output->begin(), output->end(), '/', '\\');
#else
  TrimWhitespaceUTF8(text.value(), TRIM_ALL, output);
#endif
}

Project: Chrome

std::string URLFixerUpper::SegmentURL(const std::string& text,
                                      url_parse::Parsed* parts) {
  *parts = url_parse::Parsed();

  std::string trimmed;
  TrimWhitespaceUTF8(text, TRIM_ALL, &trimmed);
  if (trimmed.empty())
    return std::string();  // Nothing to segment.

#if defined(OS_WIN)
  int trimmed_length = static_cast<int>(trimmed.length());
  if (url_parse::DoesBeginWindowsDriveSpec(trimmed.data(), 0, trimmed_length) ||
      url_parse::DoesBeginUNCPath(trimmed.data(), 0, trimmed_length, true))
    return "file";
#elif defined(OS_POSIX)
  if (FilePath::IsSeparator(trimmed.data()[0]) || trimmed.data()[0] == '~')
    return "file";
#endif

  std::string scheme;
  if (!GetValidScheme(text, &parts->scheme, &scheme)) {
    parts->scheme.reset();
    scheme.assign(StartsWithASCII(text, "ftp.", false) ?
        chrome::kFtpScheme : chrome::kHttpScheme);
  }

  if ((scheme != chrome::kAboutScheme) && (scheme != chrome::kChromeUIScheme) &&
      ((scheme == chrome::kFileScheme) || !url_util::IsStandard(scheme.c_str(),
           url_parse::Component(0, static_cast<int>(scheme.length())))))
    return scheme;

  if (parts->scheme.is_valid()) {
    url_parse::ParseStandardURL(text.data(), static_cast<int>(text.length()),
                                parts);
    return scheme;
  }

  std::string::const_iterator first_nonwhite = text.begin();
  while ((first_nonwhite != text.end()) && IsWhitespace(*first_nonwhite))
    ++first_nonwhite;

  std::string inserted_text(scheme);
  inserted_text.append(chrome::kStandardSchemeSeparator);
  std::string text_to_parse(text.begin(), first_nonwhite);
  text_to_parse.append(inserted_text);
  text_to_parse.append(first_nonwhite, text.end());

  url_parse::ParseStandardURL(text_to_parse.data(),
                              static_cast<int>(text_to_parse.length()),
                              parts);

  const int offset = -static_cast<int>(inserted_text.length());
  OffsetComponent(offset, &parts->scheme);
  OffsetComponent(offset, &parts->username);
  OffsetComponent(offset, &parts->password);
  OffsetComponent(offset, &parts->host);
  OffsetComponent(offset, &parts->port);
  OffsetComponent(offset, &parts->path);
  OffsetComponent(offset, &parts->query);
  OffsetComponent(offset, &parts->ref);

  return scheme;
}

Project: Chrome

string16 URLFixerUpper::SegmentURL(const string16& text,
                                   url_parse::Parsed* parts) {
  std::string text_utf8 = UTF16ToUTF8(text);
  url_parse::Parsed parts_utf8;
  std::string scheme_utf8 = SegmentURL(text_utf8, &parts_utf8);
  UTF8PartsToUTF16Parts(text_utf8, parts_utf8, parts);
  return UTF8ToUTF16(scheme_utf8);
}

Project: Chrome

TrimPositions TrimWhitespaceUTF8(const std::string& input,
                                 TrimPositions positions,
                                 std::string* output) {
  DCHECK(IsStringUTF8(input));
  string16 input16 = UTF8ToUTF16(input);
  string16 output16;
  TrimPositions result = TrimWhitespace(input16, positions, &output16);
  *output = UTF16ToUTF8(output16);
  return result;
}

Project: Chrome

url_parse::Component UTF8ComponentToUTF16Component(
    const std::string& text_utf8,
    const url_parse::Component& component_utf8) {
  if (component_utf8.len == -1)
    return url_parse::Component();

  std::string before_component_string =
      text_utf8.substr(0, component_utf8.begin);
  std::string component_string = text_utf8.substr(component_utf8.begin,
                                                  component_utf8.len);
  string16 before_component_string_16 = UTF8ToUTF16(before_component_string);
  string16 component_string_16 = UTF8ToUTF16(component_string);
  url_parse::Component component_16(before_component_string_16.length(),
                                    component_string_16.length());
  return component_16;
}

Project: Chrome

void UTF8PartsToUTF16Parts(const std::string& text_utf8,
                           const url_parse::Parsed& parts_utf8,
                           url_parse::Parsed* parts) {
  if (IsStringASCII(text_utf8)) {
    *parts = parts_utf8;
    return;
  }

  parts->scheme =
      UTF8ComponentToUTF16Component(text_utf8, parts_utf8.scheme);
  parts ->username =
      UTF8ComponentToUTF16Component(text_utf8, parts_utf8.username);
  parts->password =
      UTF8ComponentToUTF16Component(text_utf8, parts_utf8.password);
  parts->host =
      UTF8ComponentToUTF16Component(text_utf8, parts_utf8.host);
  parts->port =
      UTF8ComponentToUTF16Component(text_utf8, parts_utf8.port);
  parts->path =
      UTF8ComponentToUTF16Component(text_utf8, parts_utf8.path);
  parts->query =
      UTF8ComponentToUTF16Component(text_utf8, parts_utf8.query);
  parts->ref =
      UTF8ComponentToUTF16Component(text_utf8, parts_utf8.ref);
}

Project: Chrome

static bool ValidPathForFile(const FilePath::StringType& text,
                             FilePath* full_path) {
  FilePath file_path(text);
  if (!file_util::AbsolutePath(&file_path))
    return false;

  if (!file_util::PathExists(file_path))
    return false;

  *full_path = file_path;
  return true;
}