Fix handling of escaped slashes ("%2f") in FTP paths.

net/ftp/ftp_network_transaction_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/ftp/ftp_network_transaction.h"
 
 #include "build/build_config.h"
 
 #include "base/compiler_specific.h"
 #include "base/macros.h"
@@ skipping 412 matching lines @@
         return Verify("RETR /file\r\n", data, PRE_QUIT, "200 OK\r\n");
       default:
         return FtpSocketDataProvider::OnWrite(data);
     }
   }
 
  private:
   DISALLOW_COPY_AND_ASSIGN(FtpSocketDataProviderFileDownload);
 };
 
+class FtpSocketDataProviderPathSeparatorsNotUnescaped
+    : public FtpSocketDataProvider {
+ public:
+  FtpSocketDataProviderPathSeparatorsNotUnescaped() {}
+
+  MockWriteResult OnWrite(const std::string& data) override {
+    if (InjectFault())
+      return MockWriteResult(ASYNC, data.length());
+    switch (state()) {
+      case PRE_SIZE:
+        return Verify("SIZE /foo%2f..%2fbar%5c\r\n", data, PRE_CWD,
+                      "213 18\r\n");
+      case PRE_CWD:
+        return Verify("CWD /foo%2f..%2fbar%5c\r\n", data,
+                      use_epsv() ? PRE_RETR_EPSV : PRE_RETR_PASV,
+                      "550 Not a directory\r\n");
+      case PRE_RETR:
+        return Verify("RETR /foo%2f..%2fbar%5c\r\n", data, PRE_QUIT,
+                      "200 OK\r\n");
+      default:
+        return FtpSocketDataProvider::OnWrite(data);
+    }
+  }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(FtpSocketDataProviderPathSeparatorsNotUnescaped);
+};
+
 class FtpSocketDataProviderFileNotFound : public FtpSocketDataProvider {
  public:
   FtpSocketDataProviderFileNotFound() {
   }
 
   MockWriteResult OnWrite(const std::string& data) override {
     if (InjectFault())
       return MockWriteResult(ASYNC, data.length());
     switch (state()) {
       case PRE_SIZE:
@@ skipping 859 matching lines @@
 TEST_P(FtpNetworkTransactionTest, DownloadTransactionSpaceInLogin) {
   FtpSocketDataProviderEvilLogin ctrl_socket("hello world", "test");
   ExecuteTransaction(&ctrl_socket, "ftp://hello%20world:test@host/file", OK);
 }
 
 TEST_P(FtpNetworkTransactionTest, DownloadTransactionSpaceInPassword) {
   FtpSocketDataProviderEvilLogin ctrl_socket("test", "hello world");
   ExecuteTransaction(&ctrl_socket, "ftp://test:hello%20world@host/file", OK);
 }
 
+// Make sure FtpNetworkTransaction doesn't request paths like
+// "/foo/../bar".  Doing so wouldn't be a security issue, client side, but just
+// doesn't seem like a good idea.
+TEST_P(FtpNetworkTransactionTest,
+       DownloadTransactionPathSeparatorsNotUnescaped) {
+  FtpSocketDataProviderPathSeparatorsNotUnescaped ctrl_socket;
+  ExecuteTransaction(&ctrl_socket, "ftp://host/foo%2f..%2fbar%5c", OK);
+
+  // We pass an artificial value of 18 as a response to the SIZE command.
+  EXPECT_EQ(18, transaction_.GetResponseInfo()->expected_content_size);
+}
+
 TEST_P(FtpNetworkTransactionTest, EvilRestartUser) {
   FtpSocketDataProvider ctrl_socket1;
   ctrl_socket1.InjectFailure(FtpSocketDataProvider::PRE_PASSWD,
                              FtpSocketDataProvider::PRE_QUIT,
                              "530 Login authentication failed\r\n");
   mock_socket_factory_.AddSocketDataProvider(&ctrl_socket1);
 
   FtpRequestInfo request_info = GetRequestInfo("ftp://host/file");
 
   ASSERT_EQ(ERR_IO_PENDING,
@@ skipping 291 matching lines @@
                         FtpSocketDataProvider::PRE_TYPE,
                         "257 \"\"\r\n",
                         OK);
 }
 
 INSTANTIATE_TEST_CASE_P(FTP,
                         FtpNetworkTransactionTest,
                         ::testing::Values(AF_INET, AF_INET6));
 
 }  // namespace net