Q(Quick)WebEngineProfile: Update list of internal schemes

Disallow installing handler for "about" and everything in kStandardURLSchemes of
url/url_util.cc. Except for "gopher" which is used in tests. Suppress warning
about custom schemes for "gopher" since it's not a custom scheme.

Also lowercase the scheme in urlSchemeHandler() and removeUrlSchemeHandler().

Change-Id: I72b06d4fa6433882019405a0d600a593c8971bf1
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

1 files changed, 38 insertions, 3 deletions

diff --git a/src/core/profile_adapter.cpp b/src/core/profile_adapter.cpp
index 1b946949a..b04fa0d46 100644
--- a/src/core/profile_adapter.cpp
+++ b/src/core/profile_adapter.cpp
@@ -44,6 +44,7 @@
 #include "content/public/browser/browsing_data_remover.h"
 #include "content/public/browser/download_manager.h"
 
+#include "api/qwebengineurlscheme.h"
 #include "content_client_qt.h"
 #include "download_manager_delegate_qt.h"
 #include "net/url_request_context_getter_qt.h"
@@ -440,16 +441,50 @@ bool ProfileAdapter::removeCustomUrlSchemeHandler(QWebEngineUrlSchemeHandler *ha
 
 QWebEngineUrlSchemeHandler *ProfileAdapter::takeCustomUrlSchemeHandler(const QByteArray &scheme)
 {
-    QWebEngineUrlSchemeHandler *handler = m_customUrlSchemeHandlers.take(scheme);
+    QWebEngineUrlSchemeHandler *handler = m_customUrlSchemeHandlers.take(scheme.toLower());
     if (handler)
         updateCustomUrlSchemeHandlers();
     return handler;
 }
 
-void ProfileAdapter::addCustomUrlSchemeHandler(const QByteArray &scheme, QWebEngineUrlSchemeHandler *handler)
+bool ProfileAdapter::addCustomUrlSchemeHandler(const QByteArray &scheme, QWebEngineUrlSchemeHandler *handler)
 {
-    m_customUrlSchemeHandlers.insert(scheme, handler);
+    static const QSet<QByteArray> blacklist{
+        QByteArrayLiteral("about"),
+        QByteArrayLiteral("blob"),
+        QByteArrayLiteral("data"),
+        QByteArrayLiteral("javascript"),
+        QByteArrayLiteral("qrc"),
+        // See also kStandardURLSchemes in url/url_util.cc (through url::IsStandard below)
+    };
+
+    static const QSet<QByteArray> whitelist{
+        QByteArrayLiteral("gopher"),
+    };
+
+    const QByteArray canonicalScheme = scheme.toLower();
+    bool standardSyntax = url::IsStandard(canonicalScheme.data(), url::Component(0, canonicalScheme.size()));
+    bool customScheme = QWebEngineUrlScheme::schemeByName(canonicalScheme) != QWebEngineUrlScheme();
+    bool blacklisted = blacklist.contains(canonicalScheme) || (standardSyntax && !customScheme);
+    bool whitelisted = whitelist.contains(canonicalScheme);
+
+    if (blacklisted && !whitelisted) {
+        qWarning("Cannot install a URL scheme handler overriding internal scheme: %s", scheme.constData());
+        return false;
+    }
+
+    if (m_customUrlSchemeHandlers.value(canonicalScheme, handler) != handler) {
+        qWarning("URL scheme handler already installed for the scheme: %s", scheme.constData());
+        return false;
+    }
+
+    if (!whitelisted && !customScheme)
+        qWarning("Please register the custom scheme '%s' via QWebEngineUrlScheme::registerScheme() "
+                 "before installing the custom scheme handler.", scheme.constData());
+
+    m_customUrlSchemeHandlers.insert(canonicalScheme, handler);
     updateCustomUrlSchemeHandlers();
+    return true;
 }
 
 void ProfileAdapter::clearCustomUrlSchemeHandlers()