Don't call lower() on KURL protocol/host

third_party/WebKit/Source/core/dom/Document.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2012 Apple Inc. All
  * rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved.
@@ skipping 4385 matching lines @@
                                       "' scheme.");
     return;
   }
 
   if (newDomain.isEmpty()) {
     exceptionState.throwSecurityError("'" + newDomain +
                                       "' is an empty domain.");
     return;
   }
 
-  OriginAccessEntry accessEntry(getSecurityOrigin()->protocol(), newDomain,
+  // TODO(csharrison): Should probably ensure newDomain is canonical rather than

[brettw, 2016/10/26 17:51:46]

definitely!

[Charlie Harrison, 2016/10/26 18:10:59]

Yes, it looks like we are missing step 4 here (parse the host):
https://html.spec.whatwg.org/multipage/browsers.html#dom-document-domain

Do you have a sense for how critical this error is? Can we fix it in a follow
up? I think there is no functionality in Blink to canonicalize hosts (there is a
anon function in SchemeHostPort that we will likely have to share).

+  // just lowercasing it.
+  OriginAccessEntry accessEntry(getSecurityOrigin()->protocol(),
+                                newDomain.lower(),
                                 OriginAccessEntry::AllowSubdomains);
   OriginAccessEntry::MatchResult result =
       accessEntry.matchesOrigin(*getSecurityOrigin());
   if (result == OriginAccessEntry::DoesNotMatchOrigin) {
     exceptionState.throwSecurityError(
         "'" + newDomain + "' is not a suffix of '" + domain() + "'.");
     return;
   }
 
   if (result == OriginAccessEntry::MatchesOriginButIsPublicSuffix) {
@@ skipping 1993 matching lines @@
 }
 
 void showLiveDocumentInstances() {
   WeakDocumentSet& set = liveDocumentSet();
   fprintf(stderr, "There are %u documents currently alive:\n", set.size());
   for (Document* document : set)
     fprintf(stderr, "- Document %p URL: %s\n", document,
             document->url().getString().utf8().data());
 }
 #endif