android: Stricter android-app:// referrer handling.

chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java

Index: chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java b/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
index 31e60622eb19b56d0a0f81aeeb2797d2c3baad6f..ffed54cf382a64c01078bbfdfff31448f2896f94 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/IntentHandler.java
@@ -417,7 +417,7 @@ public class IntentHandler {
                 IntentUtils.safeGetIntExtra(intent, EXTRA_REFERRER_ID, 0));
         if (!TextUtils.isEmpty(referrerUrl)) {
             return referrerUrl;
-        } else if (isValidReferrerHeader(referrerExtra.toString())) {
+        } else if (isValidReferrerHeader(referrerExtra)) {
             return referrerExtra.toString();
         } else if (IntentHandler.isIntentChromeOrFirstParty(intent)) {
             return referrerExtra.toString();
@@ -441,8 +441,9 @@ public class IntentHandler {
         if (bundleExtraHeaders == null) return null;
         for (String key : bundleExtraHeaders.keySet()) {
             String value = bundleExtraHeaders.getString(key);
-            if ("referer".equals(key.toLowerCase(Locale.US)) && isValidReferrerHeader(value)) {
-                return value;
+            if (value != null && "referer".equals(key.toLowerCase(Locale.US))) {
+                Uri referrer = Uri.parse(value).normalizeScheme();
+                if (isValidReferrerHeader(referrer)) return referrer.toString();
             }
         }
         return null;
@@ -467,9 +468,11 @@ public class IntentHandler {
      * @return Whether that the given referrer is of the format that Chrome allows external
      * apps to specify.
      */
-    private static boolean isValidReferrerHeader(String referrer) {
-        return referrer != null
-                && referrer.toLowerCase(Locale.US).startsWith(ANDROID_APP_REFERRER_SCHEME + "://");
+    private static boolean isValidReferrerHeader(Uri referrer) {
+        if (referrer == null) return false;
+        Uri normalized = referrer.normalizeScheme();
+        return TextUtils.equals(normalized.getScheme(), ANDROID_APP_REFERRER_SCHEME)
+                && !TextUtils.isEmpty(normalized.getHost());
     }
 
     /**