Merge 285492 "Don't allow null bytes in hosts of host permissions."

extensions/common/url_pattern.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/common/url_pattern.h"
 
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_piece.h"
 #include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
@@ skipping 32 matching lines @@
                must_keep_these_arrays_in_sync);
 
 const char kParseSuccess[] = "Success.";
 const char kParseErrorMissingSchemeSeparator[] = "Missing scheme separator.";
 const char kParseErrorInvalidScheme[] = "Invalid scheme.";
 const char kParseErrorWrongSchemeType[] = "Wrong scheme type.";
 const char kParseErrorEmptyHost[] = "Host can not be empty.";
 const char kParseErrorInvalidHostWildcard[] = "Invalid host wildcard.";
 const char kParseErrorEmptyPath[] = "Empty path.";
 const char kParseErrorInvalidPort[] = "Invalid port.";
+const char kParseErrorInvalidHost[] = "Invalid host.";
 
 // Message explaining each URLPattern::ParseResult.
 const char* const kParseResultMessages[] = {
   kParseSuccess,
   kParseErrorMissingSchemeSeparator,
   kParseErrorInvalidScheme,
   kParseErrorWrongSchemeType,
   kParseErrorEmptyHost,
   kParseErrorInvalidHostWildcard,
   kParseErrorEmptyPath,
   kParseErrorInvalidPort,
+  kParseErrorInvalidHost,
 };
 
 COMPILE_ASSERT(URLPattern::NUM_PARSE_RESULTS == arraysize(kParseResultMessages),
                must_add_message_for_each_parse_result);
 
 const char kPathSeparator[] = "/";
 
 bool IsStandardScheme(const std::string& scheme) {
   // "*" gets the same treatment as a standard scheme.
   if (scheme == "*")
@@ skipping 172 matching lines @@
       return PARSE_ERROR_INVALID_PORT;
     host_ = host_.substr(0, port_pos);
   }
 
   // No other '*' can occur in the host, though. This isn't necessary, but is
   // done as a convenience to developers who might otherwise be confused and
   // think '*' works as a glob in the host.
   if (host_.find('*') != std::string::npos)
     return PARSE_ERROR_INVALID_HOST_WILDCARD;
 
+  // Null characters are not allowed in hosts.
+  if (host_.find('\0') != std::string::npos)
+    return PARSE_ERROR_INVALID_HOST;
+
   return PARSE_SUCCESS;
 }
 
 void URLPattern::SetValidSchemes(int valid_schemes) {
   spec_.clear();
   valid_schemes_ = valid_schemes;
 }
 
 void URLPattern::SetHost(const std::string& host) {
   spec_.clear();
@@ skipping 279 matching lines @@
   }
 
   return result;
 }
 
 // static
 const char* URLPattern::GetParseResultString(
     URLPattern::ParseResult parse_result) {
   return kParseResultMessages[parse_result];
 }