android: Stricter android-app:// referrer handling.

chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 package org.chromium.chrome.browser;
 
 import android.app.KeyguardManager;
 import android.app.PendingIntent;
 import android.app.SearchManager;
 import android.content.ComponentName;
@@ skipping 399 matching lines @@
      * @param intent The intent from which to extract the URL.
      * @return The URL string or null if none should be used.
      */
     private static String getReferrerUrl(Intent intent) {
         Uri referrerExtra = getReferrer(intent);
         if (referrerExtra == null) return null;
         String referrerUrl = IntentHandler.getPendingReferrerUrl(
                 IntentUtils.safeGetIntExtra(intent, EXTRA_REFERRER_ID, 0));
         if (!TextUtils.isEmpty(referrerUrl)) {
             return referrerUrl;
-        } else if (isValidReferrerHeader(referrerExtra.toString())) {
+        } else if (isValidReferrerHeader(referrerExtra)) {
             return referrerExtra.toString();
         } else if (IntentHandler.isIntentChromeOrFirstParty(intent)) {
             return referrerExtra.toString();
         }
         return null;
     }
 
     /**
      * Gets the referrer, looking in the Intent extra and in the extra headers extra.
      *
      * The referrer extra takes priority over the "extra headers" one.
      *
      * @param intent The Intent containing the extras.
      * @return The referrer, or null.
      */
     public static String getReferrerUrlIncludingExtraHeaders(Intent intent) {
         String referrerUrl = getReferrerUrl(intent);
         if (referrerUrl != null) return referrerUrl;
 
         Bundle bundleExtraHeaders = IntentUtils.safeGetBundleExtra(intent, Browser.EXTRA_HEADERS);
         if (bundleExtraHeaders == null) return null;
         for (String key : bundleExtraHeaders.keySet()) {
             String value = bundleExtraHeaders.getString(key);
-            if ("referer".equals(key.toLowerCase(Locale.US)) && isValidReferrerHeader(value)) {
-                return value;
+            if (value != null && "referer".equals(key.toLowerCase(Locale.US))) {
+                Uri referrer = Uri.parse(value).normalizeScheme();
+                if (isValidReferrerHeader(referrer)) return referrer.toString();
             }
         }
         return null;
     }
 
     /**
      * Add referrer and extra headers to a {@link LoadUrlParams}, if we managed to parse them from
      * the intent.
      * @param params The {@link LoadUrlParams} to add referrer and headers.
      * @param intent The intent we use to parse the extras.
      */
     public static void addReferrerAndHeaders(LoadUrlParams params, Intent intent) {
         String referrer = getReferrerUrlIncludingExtraHeaders(intent);
         if (referrer != null) {
             params.setReferrer(new Referrer(referrer, Referrer.REFERRER_POLICY_DEFAULT));
         }
         String headers = getExtraHeadersFromIntent(intent);
         if (headers != null) params.setVerbatimHeaders(headers);
     }
 
     /**
      * @return Whether that the given referrer is of the format that Chrome allows external
      * apps to specify.
      */
-    private static boolean isValidReferrerHeader(String referrer) {
-        return referrer != null
-                && referrer.toLowerCase(Locale.US).startsWith(ANDROID_APP_REFERRER_SCHEME + "://");
+    private static boolean isValidReferrerHeader(Uri referrer) {
+        if (referrer == null) return false;
+        Uri normalized = referrer.normalizeScheme();
+        return TextUtils.equals(normalized.getScheme(), ANDROID_APP_REFERRER_SCHEME)
+                && !TextUtils.isEmpty(normalized.getHost());
     }
 
     /**
      * Constructs a valid referrer using the given authority.
      * @param authority The authority to use.
      * @return Referrer with default policy that uses the valid android app scheme.
      */
     public static Referrer constructValidReferrerForAuthority(String authority) {
         return new Referrer(new Uri.Builder().scheme(ANDROID_APP_REFERRER_SCHEME)
                 .authority(authority).build().toString(), Referrer.REFERRER_POLICY_DEFAULT);
@@ skipping 558 matching lines @@
     }
 
     /**
      * @param intent An Intent to be checked.
      * @return The launch type of the tab to be created.
      */
     public static TabLaunchType getTabLaunchType(Intent intent) {
         return IntentUtils.safeGetSerializableExtra(intent, EXTRA_TAB_LAUNCH_TYPE);
     }
 }