Take care of a FIXME in SecurityOrigin.cpp to check the validity of any innerURL during constructio…

Source/platform/weborigin/SecurityOrigin.cpp

 /*
  * Copyright (C) 2007 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 79 matching lines @@
 {
     s_originCache = originCache;
 }
 
 static bool shouldTreatAsUniqueOrigin(const KURL& url)
 {
     if (!url.isValid())
         return true;
 
     // FIXME: Do we need to unwrap the URL further?
-    KURL innerURL = SecurityOrigin::shouldUseInnerURL(url) ? SecurityOrigin::extractInnerURL(url) : url;
-
-    // FIXME: Check whether innerURL is valid.
+    KURL relevantURL;
+    if (SecurityOrigin::shouldUseInnerURL(url)) {
+        relevantURL = SecurityOrigin::extractInnerURL(url);
+        if (!relevantURL.isValid())
+            return true;
+    } else {
+        relevantURL = url;
+    }
 
     // For edge case URLs that were probably misparsed, make sure that the origin is unique.
     // FIXME: Do we really need to do this? This looks to be a hack around a
     // security bug in CFNetwork that might have been fixed.
-    if (schemeRequiresAuthority(innerURL) && innerURL.host().isEmpty())
+    if (schemeRequiresAuthority(relevantURL) && relevantURL.host().isEmpty())

[sof, 2015/08/25 13:39:52]

If relevantURL is now checked for validity, is this check needed? The
String(Impl) allocation churn it brings, pains me :)

[michaeln, 2015/08/25 22:47:42]

hmmm... good question... i'm not sure?

         return true;
 
     // SchemeRegistry needs a lower case protocol because it uses HashMaps
     // that assume the scheme has already been canonicalized.
-    String protocol = innerURL.protocol().lower();
+    String protocol = relevantURL.protocol().lower();
 
     if (SchemeRegistry::shouldTreatURLSchemeAsNoAccess(protocol))
         return true;
 
     // This is the common case.
     return false;
 }
 
 SecurityOrigin::SecurityOrigin(const KURL& url)
     : m_protocol(url.protocol().isNull() ? "" : url.protocol().lower())
@@ skipping 421 matching lines @@
 }
 
 void SecurityOrigin::transferPrivilegesFrom(const SecurityOrigin& origin)
 {
     m_universalAccess = origin.m_universalAccess;
     m_canLoadLocalResources = origin.m_canLoadLocalResources;
     m_blockLocalAccessFromLocalOrigin = origin.m_blockLocalAccessFromLocalOrigin;
 }
 
 } // namespace blink