Fix invalid URIs generated using Uri constructor with clever paths.

sdk/lib/core/uri.dart

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of dart.core;
 
 // Frequently used character codes.
 const int _SPACE = 0x20;
 const int _PERCENT = 0x25;
 const int _PLUS = 0x2B;
@@ skipping 1452 matching lines @@
     port = _makePort(port, scheme);
     bool isFile = (scheme == "file");
     if (host == null &&
         (userInfo.isNotEmpty || port != null || isFile)) {
       host = "";
     }
     bool hasAuthority = (host != null);
     path = _makePath(path, 0, _stringOrNullLength(path), pathSegments,
                      scheme, hasAuthority);
     if (scheme.isEmpty && host == null && !path.startsWith('/')) {
-      path = _normalizeRelativePath(path);
+      path = _normalizeRelativePath(path, scheme.isNotEmpty || host != null);

[floitsch, 2017/01/12 16:05:49]

I generally assign boolean variables to locals first:
bool allowScheme = scheme.isNotEmpty || host != null;
path = _normalizeRelativePath(path, allowScheme);

There is no verification that the names match, but if they do, then the reader
has a better understanding of what is passed in.

[Lasse Reichstein Nielsen, 2017/01/16 08:17:23]

Done.

     } else {
       path = _removeDotSegments(path);
     }
+    if (host == null && path.startsWith("//")) {
+      host = "";
+    }
     return new _Uri._internal(scheme, userInfo, host, port,
                               path, query, fragment);
   }
 
   /// Implementation of [Uri.http].
   factory _Uri.http(String authority,
                     String unencodedPath,
                     [Map<String, String> queryParameters]) {
     return _makeHttpUri("http", authority, unencodedPath, queryParameters);
   }
@@ skipping 564 matching lines @@
     return result;
   }
 
   /// Performs path normalization (remove dot segments) on a path.
   ///
   /// If the URI has neither scheme nor authority, it's considered a
   /// "pure path" and normalization won't remove leading ".." segments.
   /// Otherwise it follows the RFC 3986 "remove dot segments" algorithm.
   static String _normalizePath(String path, String scheme, bool hasAuthority) {
     if (scheme.isEmpty && !hasAuthority && !path.startsWith('/')) {
-      return _normalizeRelativePath(path);
+      return _normalizeRelativePath(path, scheme.isNotEmpty || hasAuthority);
     }
     return _removeDotSegments(path);
   }
 
   static String _makeQuery(
       String query, int start, int end,
       Map<String, dynamic/*String|Iterable<String>*/> queryParameters) {
     if (query != null) {
       if (queryParameters != null) {
         throw new ArgumentError('Both query and queryParameters specified');
@@ skipping 275 matching lines @@
       } else {
         output.add(segment);
       }
     }
     if (appendSlash) output.add("");
     return output.join("/");
   }
 
   /// Removes all `.` segments and any non-leading `..` segments.
   ///
+  /// If the path starts with something that looks like a scheme,
+  /// and [allowScheme] is false, the colon is escaped.
+  ///
   /// Removing the ".." from a "bar/foo/.." sequence results in "bar/"
   /// (trailing "/"). If the entire path is removed (because it contains as
   /// many ".." segments as real segments), the result is "./".
   /// This is different from an empty string, which represents "no path",
   /// when you resolve it against a base URI with a path with a non-empty
   /// final segment.
-  static String _normalizeRelativePath(String path) {
+  static String _normalizeRelativePath(String path, bool allowScheme) {
     assert(!path.startsWith('/'));  // Only get called for relative paths.
-    if (!_mayContainDotSegments(path)) return path;
+    if (!_mayContainDotSegments(path)) {
+      if (!allowScheme) path = _escapeScheme(path);
+      return path;
+    }
     assert(path.isNotEmpty);  // An empty path would not have dot segments.
     List<String> output = [];
     bool appendSlash = false;
     for (String segment in path.split("/")) {
       appendSlash = false;
       if (".." == segment) {
         if (!output.isEmpty && output.last != "..") {
           output.removeLast();
           appendSlash = true;
         } else {
           output.add("..");
         }
       } else if ("." == segment) {
         appendSlash = true;
       } else {
         output.add(segment);
       }
     }
     if (output.isEmpty || (output.length == 1 && output[0].isEmpty)) {
       return "./";
     }
     if (appendSlash || output.last == '..') output.add("");
+    if (!allowScheme) output[0] = _escapeScheme(output[0]);
     return output.join("/");
   }
 
+  /// If [path] starts with a valid scheme, escape the percent.
+  static String _escapeScheme(String path) {
+    if (path.length >= 2 && _isAlphabeticCharacter(path.codeUnitAt(0))) {
+      for (int i = 1; i < path.length; i++) {
+        int char = path.codeUnitAt(i);
+        if (char == _COLON) {
+          return "${path.substring(0, i)}%3A${path.substring(i + 1)}";
+        }
+        if (char > 127 ||
+            ((_schemeTable[char >> 4] & (1 << (char & 0x0f))) == 0)) {
+          break;
+        }
+      }
+    }
+    return path;
+  }
+
   Uri resolve(String reference) {
     return resolveUri(Uri.parse(reference));
   }
 
   Uri resolveUri(Uri reference) {
     // From RFC 3986.
     String targetScheme;
     String targetUserInfo = "";
     String targetHost;
     int targetPort;
@@ skipping 51 matching lines @@
               }
             } else {
               var mergedPath = _mergePaths(this._path, reference.path);
               if (this.hasScheme || this.hasAuthority || this.hasAbsolutePath) {
                 targetPath = _removeDotSegments(mergedPath);
               } else {
                 // Non-RFC 3986 behavior.
                 // If both base and reference are relative paths,
                 // allow the merged path to start with "..".
                 // The RFC only specifies the case where the base has a scheme.
-                targetPath = _normalizeRelativePath(mergedPath);
+                targetPath = _normalizeRelativePath(mergedPath,
+                  this.hasScheme || this.hasAuthority);
               }
             }
           }
           if (reference.hasQuery) targetQuery = reference.query;
         }
       }
     }
     String fragment = reference.hasFragment ? reference.fragment : null;
     return new _Uri._internal(targetScheme,
                               targetUserInfo,
@@ skipping 116 matching lines @@
   UriData get data => (scheme == "data") ? new UriData.fromUri(this) : null;
 
   String toString() {
     return _text ??= _initializeText();
   }
 
   String _initializeText() {
     assert(_text == null);
     StringBuffer sb = new StringBuffer();
     if (scheme.isNotEmpty) sb..write(scheme)..write(":");
-    if (hasAuthority || path.startsWith("//") || (scheme == "file")) {
+    if (hasAuthority || (scheme == "file")) {
       // File URIS always have the authority, even if it is empty.
       // The empty URI means "localhost".
       sb.write("//");
       _writeAuthority(sb);
     }
     sb.write(path);
     if (_query != null) sb..write("?")..write(_query);
     if (_fragment != null) sb..write("#")..write(_fragment);
     return sb.toString();
   }
@@ skipping 1858 matching lines @@
   int delta = (text.codeUnitAt(start + 4) ^ _COLON) * 3;
   delta |= text.codeUnitAt(start)     ^ 0x64 /*d*/;
   delta |= text.codeUnitAt(start + 1) ^ 0x61 /*a*/;
   delta |= text.codeUnitAt(start + 2) ^ 0x74 /*t*/;
   delta |= text.codeUnitAt(start + 3) ^ 0x61 /*a*/;
   return delta;
 }
 
 /// Helper function returning the length of a string, or `0` for `null`.
 int _stringOrNullLength(String s) => (s == null) ? 0 : s.length;