Strip the scheme off of uris passed into the native extension loader.

runtime/bin/loader.cc

 // Copyright (c) 2016, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 
 #include "bin/loader.h"
 
 #include "bin/builtin.h"
 #include "bin/dartutils.h"
 #include "bin/extensions.h"
@@ skipping 278 matching lines @@
     // Fall through
     loader->error_ = Dart_NewUnhandledExceptionError(error);
     return false;
   }
 
 
   if (result->tag == _Dart_kImportExtension) {
     ASSERT(library_uri != Dart_Null());
     Dart_Handle library = Dart_LookupLibrary(library_uri);
     ASSERT(!Dart_IsError(library));
-    const char* lib_path_str = reinterpret_cast<const char*>(result->payload);
+    const char* lib_uri = reinterpret_cast<const char*>(result->payload);
+    if (strncmp(lib_uri, "http://", 7) == 0 ||
+        strncmp(lib_uri, "https://", 8) == 0) {
+      loader->error_ =
+        Dart_NewApiError("Cannot load native extensions over http: or https:");
+        return false;
+    }
     const char* extension_uri = reinterpret_cast<const char*>(result->uri);
+    const char* lib_path = DartUtils::RemoveScheme(lib_uri);
     const char* extension_path = DartUtils::RemoveScheme(extension_uri);
     if (strchr(extension_path, '/') != NULL ||
         (IsWindowsHost() && strchr(extension_path, '\\') != NULL)) {
       loader->error_ = DartUtils::NewError(
           "Relative paths for dart extensions are not supported: '%s'",
           extension_path);
       return false;
     }
-    Dart_Handle result = Extensions::LoadExtension(lib_path_str,
+    Dart_Handle result = Extensions::LoadExtension(lib_path,
                                                    extension_path,
                                                    library);
     if (Dart_IsError(result)) {
       loader->error_ = result;
       return false;
     }
     return true;
   }
 
   // Check for payload and load accordingly.
@@ skipping 416 matching lines @@
   MutexLocker ml(loader_infos_lock_);
   Loader* loader = LoaderForLocked(dest_port_id);
   if (loader == NULL) {
     return;
   }
   loader->QueueMessage(message);
 }
 
 }  // namespace bin
 }  // namespace dart