DoResolveRelative must not parse mailto schemes as path URLs.

url/url_util.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "url/url_util.h"
 
 #include <string.h>
 #include <vector>
 
 #include "base/debug/leak_annotations.h"
@@ skipping 221 matching lines @@
   }
 
   // Pretend for a moment that |base_spec| is a standard URL. Normally
   // non-standard URLs are treated as PathURLs, but if the base has an
   // authority we would like to preserve it.
   if (is_relative && base_is_authority_based && !standard_base_scheme) {
     Parsed base_parsed_authority;
     ParseStandardURL(base_spec, base_spec_len, &base_parsed_authority);
     if (base_parsed_authority.host.is_nonempty()) {
       bool did_resolve_succeed =
           ResolveRelativeURL(base_spec, base_parsed_authority, false, relative,

[brettw, 2014/12/01 20:15:09]

This should write into your temporary buffer rather than you copying out of it
and then filling it back in.

                              relative_component, charset_converter, output,
                              output_parsed);
       // The output_parsed is incorrect at this point (because it was built
       // based on base_parsed_authority instead of base_parsed) and needs to be
       // re-created.
-      ParsePathURL(output->data(), output->length(), true,
-                   output_parsed);
+      RawCanonOutputT<char> full_spec;
+      full_spec.Append(output->data(), output->length());
+      output->set_length(0);
+      DoCanonicalize(full_spec.data(), full_spec.length(), true,
+                     charset_converter, output, output_parsed);
       return did_resolve_succeed;
     }
   } else if (is_relative) {
     // Relative, resolve and canonicalize.
     bool file_base_scheme = base_parsed.scheme.is_nonempty() &&
         DoCompareSchemeComponent(base_spec, base_parsed.scheme, kFileScheme);
     return ResolveRelativeURL(base_spec, base_parsed, file_base_scheme, relative,
                               relative_component, charset_converter, output,
                               output_parsed);
   }
@@ skipping 316 matching lines @@
   return DoCompareSchemeComponent(spec, component, compare_to);
 }
 
 bool CompareSchemeComponent(const base::char16* spec,
                             const Component& component,
                             const char* compare_to) {
   return DoCompareSchemeComponent(spec, component, compare_to);
 }
 
 }  // namespace url