Don't call lower() on KURL protocol/host

third_party/WebKit/Source/platform/weborigin/SecurityOrigin.cpp

 /*
  * Copyright (C) 2007 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 16 matching lines @@
  */
 
 #include "platform/weborigin/SecurityOrigin.h"
 
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/weborigin/KURL.h"
 #include "platform/weborigin/KnownPorts.h"
 #include "platform/weborigin/SchemeRegistry.h"
 #include "platform/weborigin/SecurityPolicy.h"
 #include "platform/weborigin/URLSecurityOriginMap.h"
+#include "url/url_canon.h"
 #include "url/url_canon_ip.h"
 #include "wtf/HexNumber.h"
 #include "wtf/NotFound.h"
 #include "wtf/PtrUtil.h"
 #include "wtf/StdLibExtras.h"
 #include "wtf/text/StringBuilder.h"
 #include "wtf/text/StringUTF8Adaptor.h"
 #include <memory>
 
 namespace blink {
@@ skipping 49 matching lines @@
     relevantURL = url;
   }
 
   // URLs with schemes that require an authority, but which don't have one,
   // will have failed the isValid() test; e.g. valid HTTP URLs must have a
   // host.
   ASSERT(!(
       (relevantURL.protocolIsInHTTPFamily() || relevantURL.protocolIs("ftp")) &&
       relevantURL.host().isEmpty()));
 
-  // SchemeRegistry needs a lower case protocol because it uses HashMaps
-  // that assume the scheme has already been canonicalized.
-  String protocol = relevantURL.protocol().lower();
-
-  if (SchemeRegistry::shouldTreatURLSchemeAsNoAccess(protocol))
+  if (SchemeRegistry::shouldTreatURLSchemeAsNoAccess(relevantURL.protocol()))
     return true;
 
   // This is the common case.
   return false;
 }
 
 SecurityOrigin::SecurityOrigin(const KURL& url)
-    : m_protocol(url.protocol().isNull() ? emptyString()
-                                         : url.protocol().lower()),
-      m_host(url.host().isNull() ? emptyString() : url.host().lower()),
+    : m_protocol(url.protocol()),
+      m_host(url.host()),
       m_port(url.port()),
       m_effectivePort(url.port() ? url.port()
                                  : defaultPortForProtocol(m_protocol)),
       m_isUnique(false),
       m_universalAccess(false),
       m_domainWasSetInDOM(false),
       m_blockLocalAccessFromLocalOrigin(false),
       m_isUniqueOriginPotentiallyTrustworthy(false) {
+  if (m_protocol.isNull())
+    m_protocol = emptyString();
+  if (m_host.isNull())
+    m_host = emptyString();
+
   // Suborigins are serialized into the host, so extract it if necessary.
   String suboriginName;
   if (deserializeSuboriginAndProtocolAndHost(m_protocol, m_host, suboriginName,
                                              m_protocol, m_host))
     m_suborigin.setName(suboriginName);
 
   // document.domain starts as m_host, but can be set by the DOM.
   m_domain = m_host;
 
   if (isDefaultPortForProtocol(m_port, m_protocol))
@@ skipping 174 matching lines @@
   if (url.protocolIsData())
     return false;
 
   return true;
 }
 
 bool SecurityOrigin::canDisplay(const KURL& url) const {
   if (m_universalAccess)
     return true;
 
-  String protocol = url.protocol().lower();
-
+  String protocol = url.protocol();
   if (SchemeRegistry::canDisplayOnlyIfCanRequest(protocol))
     return canRequest(url);
 
   if (SchemeRegistry::shouldTreatURLSchemeAsDisplayIsolated(protocol))
     return m_protocol == protocol ||
            SecurityPolicy::isAccessToURLWhiteListed(this, url);
 
   if (SchemeRegistry::shouldTreatURLSchemeAsLocal(protocol))
     return canLoadLocalResources() ||
            SecurityPolicy::isAccessToURLWhiteListed(this, url);
@@ skipping 249 matching lines @@
   m_blockLocalAccessFromLocalOrigin =
       privilegeData->m_blockLocalAccessFromLocalOrigin;
 }
 
 void SecurityOrigin::setUniqueOriginIsPotentiallyTrustworthy(
     bool isUniqueOriginPotentiallyTrustworthy) {
   ASSERT(!isUniqueOriginPotentiallyTrustworthy || isUnique());
   m_isUniqueOriginPotentiallyTrustworthy = isUniqueOriginPotentiallyTrustworthy;
 }
 
+String SecurityOrigin::canonicalizeHost(const String& host, bool* success) {
+  url::Component outHost;
+  url::RawCanonOutputT<char> canonOutput;
+  if (host.is8Bit()) {
+    StringUTF8Adaptor utf8(host);
+    *success = url::CanonicalizeHost(
+        utf8.data(), url::Component(0, utf8.length()), &canonOutput, &outHost);
+  } else {
+    *success = url::CanonicalizeHost(host.characters16(),
+                                     url::Component(0, host.length()),
+                                     &canonOutput, &outHost);
+  }
+  return String::fromUTF8(canonOutput.data(), canonOutput.length());
+}
+
 }  // namespace blink