New issue
Advanced search Search tips

Issue 874455 link

Starred by 0 users

Issue metadata

Status: Fixed
Owner:
Closed: Oct 12
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Android
Pri: 2
Type: Bug
Team-Security-UX



Sign in to add a comment

Certain unescaped characters in URL query string break PageInfo links

Reported by 13hu...@gmail.com, Aug 15

Issue description

Steps to reproduce the problem:
1. Visit a url containing a query string that has one of the following characters (not escaped): | { } %
e.g. https://www.example.com/index.htm?a|b
2. Touch page info (omnibox icon)

What is the expected behavior?
Link to site settings, and details if https

What went wrong?
Site settings and details links are missing

Did this work before? N/A 

Chrome version: 68.0.3440.91  Channel: stable
OS Version: 6.0.1
Flash Version: 

Other characters may also cause this.
 
http_expected.jpeg
84.0 KB View Download
http_bug.jpeg
96.7 KB View Download
Components: -UI UI>Browser>Bubbles>PageInfo
Status: Available (was: Unconfirmed)
Was able to reproduce on stable (only on Android).
Cc: carlosil@chromium.org
Components: UI>Browser>Mobile
Looks like the issue here is that the URI constructor requires the input to already be sanitized if using the single argument string constructor, otherwise it throws an exception.
Cc: tedc...@chromium.org
tedchoc: Is there a preferred way of sanitizing URLs in Clank for a case like this? It looks like the parsed URI is not being displayed, it is just used for deciding when to show the site settings button and the connection details link, so just replacing the invalid characters before calling new URI() would do the trick, but I'm not too familiar with Clank so I don't know what the best way to do this would be.
Happy to take this bug and implement the fix once I figure that out.
Perhaps you could use URLEncoder (https://developer.android.com/reference/java/net/URLEncoder) to encode the URL first? That should percent-escape special characters like |{}%. It has pretty sparse use in Clank though....
Owner: huayinz@chromium.org
Assigning to huayinz@ to make the switch.

We likely should just call:
https://cs.chromium.org/chromium/src/chrome/android/java/src/org/chromium/chrome/browser/util/UrlUtilities.java?q=UrlUtilities.java&sq=package:chromium&g=0&l=113
to get the scheme.  They mention the exact issue here with invalid characters.

Alternatively, we could use this too:
https://cs.chromium.org/chromium/src/net/android/java/src/org/chromium/net/GURLUtils.java?q=UrlUtils.java&sq=package:chromium&g=0&l=32

The former is nicer as it doesn't have native dependencies for robolectric, but we really should converge.
Status: Assigned (was: Available)
Project Member

Comment 10 by bugdroid1@chromium.org, Oct 12

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/c84187c1507e410bbab87c7c18bb49455e04cdb9

commit c84187c1507e410bbab87c7c18bb49455e04cdb9
Author: Becky Zhou <huayinz@chromium.org>
Date: Fri Oct 12 19:04:21 2018

Fix site settings button and detail link not shown on page info

Fix site settings and detail link not shown on page info under URL
with certain unescaped characters.

Bug:  874455 
Change-Id: Icf31bee1b644136d285c5286938b16bc2b3de88c
Reviewed-on: https://chromium-review.googlesource.com/c/1278205
Commit-Queue: Becky Zhou <huayinz@chromium.org>
Reviewed-by: Ted Choc <tedchoc@chromium.org>
Cr-Commit-Position: refs/heads/master@{#599315}
[modify] https://crrev.com/c84187c1507e410bbab87c7c18bb49455e04cdb9/chrome/android/java/src/org/chromium/chrome/browser/page_info/PageInfoController.java

Status: Fixed (was: Assigned)

Sign in to add a comment