Move Service Worker %2f validation logic from browser into Blink (3)

content/browser/service_worker/service_worker_dispatcher_host.cc

Index: content/browser/service_worker/service_worker_dispatcher_host.cc
diff --git a/content/browser/service_worker/service_worker_dispatcher_host.cc b/content/browser/service_worker/service_worker_dispatcher_host.cc
index 2afe6668d3cfce2aba57c507ffda61ff2db0b0bf..0bd832ef8ad718c4115ec0ba0af06c093d754a51 100644
--- a/content/browser/service_worker/service_worker_dispatcher_host.cc
+++ b/content/browser/service_worker/service_worker_dispatcher_host.cc
@@ -56,6 +56,25 @@ bool OriginCanAccessServiceWorkers(const GURL& url) {
   return url.SchemeIsHTTPOrHTTPS() && IsOriginSecure(url);
 }
 
+bool ContainsDisallowedCharacter(const GURL& url) {
+  DCHECK(url.is_valid());
+
+  std::string path = url.path();
+  DCHECK(base::IsStringUTF8(path));
+
+  // We should avoid these escaped characters in the path component because
+  // these can be handled differently depending on server implementation.
+  if (path.find("%2f") != std::string::npos ||
+      path.find("%2F") != std::string::npos) {
+    return true;
+  }
+  if (path.find("%5c") != std::string::npos ||
+      path.find("%5C") != std::string::npos) {
+    return true;
+  }
+  return false;
+}
+
 bool CanRegisterServiceWorker(const GURL& document_url,
                               const GURL& pattern,
                               const GURL& script_url) {
@@ -332,13 +351,9 @@ void ServiceWorkerDispatcherHost::OnRegisterServiceWorker(
     return;
   }
 
-  std::string error_message;
-  if (ServiceWorkerUtils::ContainsDisallowedCharacter(pattern, script_url,
-                                                      &error_message)) {
-    Send(new ServiceWorkerMsg_ServiceWorkerRegistrationError(
-        thread_id, request_id, WebServiceWorkerError::ErrorTypeSecurity,
-        base::ASCIIToUTF16(kServiceWorkerRegisterErrorPrefix) +
-            base::UTF8ToUTF16(error_message)));
+  if (ContainsDisallowedCharacter(pattern) ||
+      ContainsDisallowedCharacter(script_url)) {

[nhiroki, 2015/07/28 05:32:13]

I'd prefer to reuse ServiceWorkerUtils::ContainsDisallowedCharacter because it's
generally difficult to keep duplicate code consistent. How about making the
function to accept null |error_message|?

+    bad_message::ReceivedBadMessage(this, bad_message::SWDH_REGISTER_CANNOT);
     return;
   }