WebDatabase: check path traversal in origin_identifier

webkit/database/database_util_unittest.cc

Index: webkit/database/database_util_unittest.cc
diff --git a/webkit/database/database_util_unittest.cc b/webkit/database/database_util_unittest.cc
index 18c701402c5e3a33fb8722a8f349e3804ce4a187..7167c889098c2311ef9be0b10ec17455562a4122 100644
--- a/webkit/database/database_util_unittest.cc
+++ b/webkit/database/database_util_unittest.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "base/string_piece.h"
 #include "base/utf_string_conversions.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "webkit/database/database_util.h"
@@ -31,6 +32,12 @@ static GURL ToAndFromOriginIdentifier(const GURL origin_url) {
   return DatabaseUtil::GetOriginFromIdentifier(id);
 }
 
+static void TestValidOriginIdentifier(bool expected_result,
+                                      const base::StringPiece id) {
+  EXPECT_EQ(expected_result,
+            DatabaseUtil::IsValidOriginIdentifier(ASCIIToUTF16(id)));
+}
+
 namespace webkit_database {
 
 // Test DatabaseUtil::CrackVfsFilePath on various inputs.
@@ -54,4 +61,11 @@ TEST(DatabaseUtilTest, OriginIdentifiers) {
   EXPECT_EQ(kHttpOrigin, ToAndFromOriginIdentifier(kHttpOrigin));
 }
 
+TEST(DatabaseUtilTest, IsValidOriginIdentifier) {

[jsbell, 2013/02/12 18:20:32]

Can you add a test case with a string containing ".." (should fail), and a test
case with empty string (should pass, edge case)

[aedla, 2013/02/12 19:27:43]

Done.

+  TestValidOriginIdentifier(true,  "http_bar_0");
+  TestValidOriginIdentifier(false, "bad/id");
+  TestValidOriginIdentifier(false, "bad\\id");
+  TestValidOriginIdentifier(false, base::StringPiece("bad\0id", 6));
+}
+
 }  // namespace webkit_database