Make XMLHttpRequest.open() throw for invalid URLs

third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp

 /*
  *  Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
  *  Copyright (C) 2005-2007 Alexey Proskuryakov <ap@webkit.org>
  *  Copyright (C) 2007, 2008 Julien Chaffraix <jchaffraix@webkit.org>
  *  Copyright (C) 2008, 2011 Google Inc. All rights reserved.
  *  Copyright (C) 2012 Intel Corporation
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
  *  License as published by the Free Software Foundation; either
@@ skipping 120 matching lines @@
     context->addConsoleMessage(consoleMessage);
 }
 
 enum HeaderValueCategoryByRFC7230 {
     HeaderValueInvalid,
     HeaderValueAffectedByNormalization,
     HeaderValueValid,
     HeaderValueCategoryByRFC7230End
 };
 
+bool validateOpenArguments(const AtomicString& method, const KURL& url, ExceptionState& exceptionState)
+{
+    if (!isValidHTTPToken(method)) {
+        exceptionState.throwDOMException(SyntaxError, "'" + method + "' is not a valid HTTP method.");
+        return false;
+    }
+
+    if (FetchUtils::isForbiddenMethod(method)) {
+        exceptionState.throwSecurityError("'" + method + "' HTTP method is unsupported.");
+        return false;
+    }
+
+    if (!url.isValid()) {
+        exceptionState.throwDOMException(SyntaxError, "Invalid URL");
+        return false;
+    }
+
+    return true;
+}
+
 } // namespace
 
 class XMLHttpRequest::BlobLoader final : public GarbageCollectedFinalized<XMLHttpRequest::BlobLoader>, public FileReaderLoaderClient {
 public:
     static BlobLoader* create(XMLHttpRequest* xhr, PassRefPtr<BlobDataHandle> handle)
     {
         return new BlobLoader(xhr, handle);
     }
 
     // FileReaderLoaderClient functions.
@@ skipping 378 matching lines @@
     if (m_state > kOpened || m_loader) {
         exceptionState.throwDOMException(InvalidStateError,  "The value may only be set if the object's state is UNSENT or OPENED.");
         return;
     }
 
     m_includeCredentials = value;
 }
 
 void XMLHttpRequest::open(const AtomicString& method, const String& urlString, ExceptionState& exceptionState)
 {
-    open(method, getExecutionContext()->completeURL(urlString), true, exceptionState);
+    KURL url(getExecutionContext()->completeURL(urlString));
+    if (!validateOpenArguments(method, url, exceptionState))
+        return;
+
+    open(method, url, true, exceptionState);
 }
 
 void XMLHttpRequest::open(const AtomicString& method, const String& urlString, bool async, const String& username, const String& password, ExceptionState& exceptionState)
 {
     KURL url(getExecutionContext()->completeURL(urlString));
+    if (!validateOpenArguments(method, url, exceptionState))
+        return;
+
     if (!username.isNull())
         url.setUser(username);
     if (!password.isNull())
         url.setPass(password);
 
     open(method, url, async, exceptionState);
 }
 
 void XMLHttpRequest::open(const AtomicString& method, const KURL& url, bool async, ExceptionState& exceptionState)
 {
     NETWORK_DVLOG(1) << this << " open(" << method << ", " << url.elidedString() << ", " << async << ")";
 
+    DCHECK(validateOpenArguments(method, url, exceptionState));
+
     if (!internalAbort())
         return;
 
     State previousState = m_state;
     m_state = kUnsent;
     m_error = false;
     m_uploadComplete = false;
 
-    if (!isValidHTTPToken(method)) {
-        exceptionState.throwDOMException(SyntaxError, "'" + method + "' is not a valid HTTP method.");
-        return;
-    }
-
-    if (FetchUtils::isForbiddenMethod(method)) {
-        exceptionState.throwSecurityError("'" + method + "' HTTP method is unsupported.");
-        return;
-    }
-
     if (!ContentSecurityPolicy::shouldBypassMainWorld(getExecutionContext()) && !getExecutionContext()->contentSecurityPolicy()->allowConnectToSource(url)) {
         // We can safely expose the URL to JavaScript, as these checks happen synchronously before redirection. JavaScript receives no new information.
         exceptionState.throwSecurityError("Refused to connect to '" + url.elidedString() + "' because it violates the document's Content Security Policy.");
         return;
     }
 
     if (!async && getExecutionContext()->isDocument()) {
         if (document()->settings() && !document()->settings()->syncXHRInDocumentsEnabled()) {
             exceptionState.throwDOMException(InvalidAccessError, "Synchronous requests are disabled for this page.");
             return;
@@ skipping 1140 matching lines @@
     visitor->traceWrappers(m_responseDocument);
     visitor->traceWrappers(m_responseArrayBuffer);
 }
 
 std::ostream& operator<<(std::ostream& ostream, const XMLHttpRequest* xhr)
 {
     return ostream << "XMLHttpRequest " << static_cast<const void*>(xhr);
 }
 
 } // namespace blink