Skip to content
This repository has been archived by the owner on Dec 11, 2019. It is now read-only.

Hardened isNotURL / isURL code in urlutil.js #6086

Merged
merged 4 commits into from
Dec 8, 2016
Merged

Hardened isNotURL / isURL code in urlutil.js #6086

merged 4 commits into from
Dec 8, 2016

Commits on Dec 8, 2016

  1. Hardened isNotURL / isURL code in urlutil.js

    Fixes #5911
    (which was unintentionally introduced with #4546)
    
    Also fixes these cases (no issues created yet):
    - view-source/mail-to/etc were not checking from beginning of string
    - ensures input is string (preventing failing call to trim())
    
    And adds missing tests for:
    - checking localhost toLowerCase()
    - checking basic auth formatted URI (with and without protocol)
    - is input a string
    - each type of special page
    - partial bad matches on special pages
    
    Also updates tests for isURL to ensure value is always negated version of isNotURL
    
    Auditors: @bbondy, @darkdh, @diracdeltas
    
    Since this code has a very large potential impact (everything from the URL bar calls this for example), please review and help make sure I covered everything safely :)
    
    Unit test:
    
    `npm run unittest -- --grep="urlutil"
    
    Webdriver test:
    
    `npm run uitest -- --grep="when following URLs"`
    bsclifton committed Dec 8, 2016
    Configuration menu
    Copy the full SHA
    bbcfe76 View commit details
    Browse the repository at this point in the history
  2. fix end with period

    darkdh committed Dec 8, 2016
    Configuration menu
    Copy the full SHA
    cd71e0e View commit details
    Browse the repository at this point in the history
  3. Configuration menu
    Copy the full SHA
    534dc14 View commit details
    Browse the repository at this point in the history
  4. Configuration menu
    Copy the full SHA
    cd88861 View commit details
    Browse the repository at this point in the history