Look closer at the components of vfsfilenames that are used filenames.

webkit/common/database/database_identifier.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/common/database/database_identifier.h"
 
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "url/url_canon.h"
 
@@ skipping 40 matching lines @@
                             origin.host(),
                             port,
                             false /* unique */,
                             false /* file */);
 }
 
 // static
 DatabaseIdentifier DatabaseIdentifier::Parse(const std::string& identifier) {
   if (!IsStringASCII(identifier))
     return DatabaseIdentifier();
+  if (identifier.find("..") != std::string::npos)

[michaeln, 2014/04/21 19:48:07]

does this exclude some valid hostnames like www..domain.com... and do we care?

+    return DatabaseIdentifier();
+  char forbidden[] = {'\\', '/', ':' ,'\0'};

[jschuh, 2014/03/24 22:46:23]

Can't we have a whitelist here instead of a blacklist?

[michaeln, 2014/04/21 19:48:07]

In talking to you i the hallway, you mentioned vetting the suffix specifically.

The scheme and host components have to survive roundtrips thru GURL. Is GURL
rigid enough about the scheme and hostnames components, particularly the scheme?
I'm queasy about second guessing what GURL accepts as valid inputs for host
components since I don't know the details of how idn names are ascii encoded.

The origin identifiers don't involve less restrictive path components, but
vfsfilenames do. In database_util.cc, the path component hold the suffix and
that is subject to a whitelist (alpha + digit + - + . + _ minus '..').

+  if (identifier.find_first_of(forbidden, 0, arraysize(forbidden)) !=
+          std::string::npos) {
+    return DatabaseIdentifier();
+  }
 
   size_t first_underscore = identifier.find_first_of('_');
   if (first_underscore == std::string::npos || first_underscore == 0)
     return DatabaseIdentifier();
 
   size_t last_underscore = identifier.find_last_of('_');
   if (last_underscore == std::string::npos ||
       last_underscore == first_underscore ||
       last_underscore == identifier.length() - 1)
     return DatabaseIdentifier();
@@ skipping 58 matching lines @@
   if (is_file_)
     return GURL("file:///");
   if (is_unique_)
     return GURL();
   if (port_ == 0)
     return GURL(scheme_ + "://" + hostname_);
   return GURL(scheme_ + "://" + hostname_ + ":" + base::IntToString(port_));
 }
 
 }  // namespace webkit_database