Do not install WebAPKs with web manifests with invalid URL components

chrome/browser/android/webapk/webapk_web_manifest_checker.cc

+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/android/webapk/webapk_web_manifest_checker.h"
+
+#include "content/public/common/manifest.h"
+#include "url/gurl.h"
+
+namespace {
+
+// Returns whether a URL in the Web Manifest is WebAPK compatible. Returns
+// NO_ERROR_DETECTED if it is compatible and the error code otherwise.
+InstallableStatusCode CheckUrlWebApkCompatible(const GURL& url) {
+  // WebAPK web manifests are stored on the Chrome WebAPK server. Do not
+  // generate WebAPKs for Web Manifests with URLs with a user name or password
+  // in order to avoid storing user names and passwords on the WebAPK server.
+  if (url.has_username() || url.has_password())
+    return URL_USERNAME_AND_PASSWORD_NOT_SUPPORTED_FOR_WEBAPK;
+
+  // For the sake of simplicity we do not generate WebAPKs for Web Manifests
+  // with URLs with a custom port.
+  if (url.has_port())
+    return URL_PORT_NOT_SUPPORTED_FOR_WEBAPK;
+
+  return NO_ERROR_DETECTED;
+}
+
+}  // anonymous namespace
+
+InstallableStatusCode CheckWebManifestUrlsWebApkCompatible(
+    const content::Manifest& manifest) {
+  InstallableStatusCode error_code = NO_ERROR_DETECTED;
+
+  for (const content::Manifest::Icon& icon : manifest.icons) {
+    error_code = CheckUrlWebApkCompatible(icon.src);
+    if (error_code != NO_ERROR_DETECTED)
+      return error_code;
+  }
+
+  // Do not check "related_applications" URLs because they are not used by
+  // WebAPKs.
+
+  error_code = CheckUrlWebApkCompatible(manifest.start_url);
+  if (error_code != NO_ERROR_DETECTED)
+    return error_code;
+
+  return CheckUrlWebApkCompatible(manifest.scope);
+}