WebDatabase: check path traversal in origin_identifier

webkit/database/database_util.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/database/database_util.h"
 
+#include "base/string_piece.h"
 #include "base/utf_string_conversions.h"
 #include "third_party/WebKit/Source/Platform/chromium/public/WebString.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebSecurityOrigin.h"
 #include "webkit/database/database_tracker.h"
 #include "webkit/database/vfs_backend.h"
 
 namespace webkit_database {
 
 const char DatabaseUtil::kJournalFileSuffix[] = "-journal";
 
@@ skipping 66 matching lines @@
   // createFromDatabaseIdentifier returns null origin_url for them.
   if (web_security_origin.isUnique()) {
     if (origin_identifier.find(UTF8ToUTF16("file__")) == 0)
       return GURL("file:///");
     return GURL();
   }
 
   return GURL(web_security_origin.toString());
 }
 
+bool DatabaseUtil::IsValidOriginIdentifier(const string16& origin_identifier) {
+  string16 dotdot = ASCIIToUTF16("..");
+  string16 forbidden = ASCIIToUTF16(base::StringPiece("\\/\0", 3));

[jsbell, 2013/02/12 18:20:32]

Given the way it was used (as a list of forbidden characters), I actually
thought it was more readable the other way, as an array initializer - { '\\',
'/', '\0' }.

[aedla, 2013/02/12 19:27:43]

Agreed, done.

+
+  string16::size_type pos = origin_identifier.find(dotdot);
+  if (pos == string16::npos)
+    pos = origin_identifier.find_first_of(forbidden);
+
+  return pos == string16::npos;
+}
+
 }  // namespace webkit_database