Q(Quick)WebEngineProfile: Update list of internal schemes

Disallow installing handler for "about" and everything in kStandardURLSchemes of
url/url_util.cc. Except for "gopher" which is used in tests. Suppress warning
about custom schemes for "gopher" since it's not a custom scheme.

Also lowercase the scheme in urlSchemeHandler() and removeUrlSchemeHandler().

Change-Id: I72b06d4fa6433882019405a0d600a593c8971bf1
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

4 files changed, 43 insertions, 64 deletions

diff --git a/src/core/profile_adapter.cpp b/src/core/profile_adapter.cpp
index 1b946949a..b04fa0d46 100644
--- a/src/core/profile_adapter.cpp
+++ b/src/core/profile_adapter.cpp
@@ -44,6 +44,7 @@
 #include "content/public/browser/browsing_data_remover.h"
 #include "content/public/browser/download_manager.h"
 
+#include "api/qwebengineurlscheme.h"
 #include "content_client_qt.h"
 #include "download_manager_delegate_qt.h"
 #include "net/url_request_context_getter_qt.h"
@@ -440,16 +441,50 @@ bool ProfileAdapter::removeCustomUrlSchemeHandler(QWebEngineUrlSchemeHandler *ha
 
 QWebEngineUrlSchemeHandler *ProfileAdapter::takeCustomUrlSchemeHandler(const QByteArray &scheme)
 {
-    QWebEngineUrlSchemeHandler *handler = m_customUrlSchemeHandlers.take(scheme);
+    QWebEngineUrlSchemeHandler *handler = m_customUrlSchemeHandlers.take(scheme.toLower());
     if (handler)
         updateCustomUrlSchemeHandlers();
     return handler;
 }
 
-void ProfileAdapter::addCustomUrlSchemeHandler(const QByteArray &scheme, QWebEngineUrlSchemeHandler *handler)
+bool ProfileAdapter::addCustomUrlSchemeHandler(const QByteArray &scheme, QWebEngineUrlSchemeHandler *handler)
 {
-    m_customUrlSchemeHandlers.insert(scheme, handler);
+    static const QSet<QByteArray> blacklist{
+        QByteArrayLiteral("about"),
+        QByteArrayLiteral("blob"),
+        QByteArrayLiteral("data"),
+        QByteArrayLiteral("javascript"),
+        QByteArrayLiteral("qrc"),
+        // See also kStandardURLSchemes in url/url_util.cc (through url::IsStandard below)
+    };
+
+    static const QSet<QByteArray> whitelist{
+        QByteArrayLiteral("gopher"),
+    };
+
+    const QByteArray canonicalScheme = scheme.toLower();
+    bool standardSyntax = url::IsStandard(canonicalScheme.data(), url::Component(0, canonicalScheme.size()));
+    bool customScheme = QWebEngineUrlScheme::schemeByName(canonicalScheme) != QWebEngineUrlScheme();
+    bool blacklisted = blacklist.contains(canonicalScheme) || (standardSyntax && !customScheme);
+    bool whitelisted = whitelist.contains(canonicalScheme);
+
+    if (blacklisted && !whitelisted) {
+        qWarning("Cannot install a URL scheme handler overriding internal scheme: %s", scheme.constData());
+        return false;
+    }
+
+    if (m_customUrlSchemeHandlers.value(canonicalScheme, handler) != handler) {
+        qWarning("URL scheme handler already installed for the scheme: %s", scheme.constData());
+        return false;
+    }
+
+    if (!whitelisted && !customScheme)
+        qWarning("Please register the custom scheme '%s' via QWebEngineUrlScheme::registerScheme() "
+                 "before installing the custom scheme handler.", scheme.constData());
+
+    m_customUrlSchemeHandlers.insert(canonicalScheme, handler);
     updateCustomUrlSchemeHandlers();
+    return true;
 }
 
 void ProfileAdapter::clearCustomUrlSchemeHandlers()
diff --git a/src/core/profile_adapter.h b/src/core/profile_adapter.h
index 7ed5c13f5..e92fb524b 100644
--- a/src/core/profile_adapter.h
+++ b/src/core/profile_adapter.h
@@ -179,7 +179,7 @@ public:
     const QHash<QByteArray, QWebEngineUrlSchemeHandler *> &customUrlSchemeHandlers() const;
     const QList<QByteArray> customUrlSchemes() const;
     void clearCustomUrlSchemeHandlers();
-    void addCustomUrlSchemeHandler(const QByteArray &, QWebEngineUrlSchemeHandler *);
+    bool addCustomUrlSchemeHandler(const QByteArray &, QWebEngineUrlSchemeHandler *);
     bool removeCustomUrlSchemeHandler(QWebEngineUrlSchemeHandler *);
     QWebEngineUrlSchemeHandler *takeCustomUrlSchemeHandler(const QByteArray &);
     UserResourceControllerHost *userResourceController();
diff --git a/src/webengine/api/qquickwebengineprofile.cpp b/src/webengine/api/qquickwebengineprofile.cpp
index 73577a04c..f77f376aa 100644
--- a/src/webengine/api/qquickwebengineprofile.cpp
+++ b/src/webengine/api/qquickwebengineprofile.cpp
@@ -847,20 +847,7 @@ void QQuickWebEngineProfile::setRequestInterceptor(QWebEngineUrlRequestIntercept
 const QWebEngineUrlSchemeHandler *QQuickWebEngineProfile::urlSchemeHandler(const QByteArray &scheme) const
 {
     const Q_D(QQuickWebEngineProfile);
-    if (d->profileAdapter()->customUrlSchemeHandlers().contains(scheme))
-        return d->profileAdapter()->customUrlSchemeHandlers().value(scheme);
-    return 0;
-}
-
-static bool checkInternalScheme(const QByteArray &scheme)
-{
-    static QSet<QByteArray> internalSchemes;
-    if (internalSchemes.isEmpty()) {
-        internalSchemes << QByteArrayLiteral("qrc") << QByteArrayLiteral("data") << QByteArrayLiteral("blob")
-                        << QByteArrayLiteral("http") << QByteArrayLiteral("https") << QByteArrayLiteral("ftp")
-                        << QByteArrayLiteral("javascript");
-    }
-    return internalSchemes.contains(scheme);
+    return d->profileAdapter()->customUrlSchemeHandlers().value(scheme.toLower());
 }
 
 /*!
@@ -873,23 +860,8 @@ void QQuickWebEngineProfile::installUrlSchemeHandler(const QByteArray &scheme, Q
 {
     Q_D(QQuickWebEngineProfile);
     Q_ASSERT(handler);
-    QByteArray canonicalScheme = scheme.toLower();
-    if (checkInternalScheme(canonicalScheme)) {
-        qWarning("Cannot install a URL scheme handler overriding internal scheme: %s", scheme.constData());
-        return;
-    }
-
-    if (d->profileAdapter()->customUrlSchemeHandlers().contains(canonicalScheme)) {
-        if (d->profileAdapter()->customUrlSchemeHandlers().value(canonicalScheme) != handler)
-            qWarning("URL scheme handler already installed for the scheme: %s", scheme.constData());
+    if (!d->profileAdapter()->addCustomUrlSchemeHandler(scheme, handler))
         return;
-    }
-
-    if (QWebEngineUrlScheme::schemeByName(canonicalScheme) == QWebEngineUrlScheme())
-        qWarning("Please register the custom scheme '%s' via QWebEngineUrlScheme::registerScheme() "
-                 "before installing the custom scheme handler.", scheme.constData());
-
-    d->profileAdapter()->addCustomUrlSchemeHandler(canonicalScheme, handler);
     connect(handler, SIGNAL(_q_destroyedUrlSchemeHandler(QWebEngineUrlSchemeHandler*)), this, SLOT(destroyedUrlSchemeHandler(QWebEngineUrlSchemeHandler*)));
 }
 
diff --git a/src/webenginewidgets/api/qwebengineprofile.cpp b/src/webenginewidgets/api/qwebengineprofile.cpp
index 929c2aaa1..c8aafa0e8 100644
--- a/src/webenginewidgets/api/qwebengineprofile.cpp
+++ b/src/webenginewidgets/api/qwebengineprofile.cpp
@@ -688,20 +688,7 @@ QWebEngineSettings *QWebEngineProfile::settings() const
 const QWebEngineUrlSchemeHandler *QWebEngineProfile::urlSchemeHandler(const QByteArray &scheme) const
 {
     const Q_D(QWebEngineProfile);
-    if (d->profileAdapter()->customUrlSchemeHandlers().contains(scheme))
-        return d->profileAdapter()->customUrlSchemeHandlers().value(scheme);
-    return 0;
-}
-
-static bool checkInternalScheme(const QByteArray &scheme)
-{
-    static QSet<QByteArray> internalSchemes;
-    if (internalSchemes.isEmpty()) {
-        internalSchemes << QByteArrayLiteral("qrc") << QByteArrayLiteral("data") << QByteArrayLiteral("blob")
-                        << QByteArrayLiteral("http") << QByteArrayLiteral("https") << QByteArrayLiteral("ftp")
-                        << QByteArrayLiteral("javascript");
-    }
-    return internalSchemes.contains(scheme);
+    return d->profileAdapter()->customUrlSchemeHandlers().value(scheme.toLower());
 }
 
 /*!
@@ -716,23 +703,8 @@ void QWebEngineProfile::installUrlSchemeHandler(const QByteArray &scheme, QWebEn
 {
     Q_D(QWebEngineProfile);
     Q_ASSERT(handler);
-    QByteArray canonicalScheme = scheme.toLower();
-    if (checkInternalScheme(canonicalScheme)) {
-        qWarning("Cannot install a URL scheme handler overriding internal scheme: %s", scheme.constData());
-        return;
-    }
-
-    if (d->profileAdapter()->customUrlSchemeHandlers().contains(canonicalScheme)) {
-        if (d->profileAdapter()->customUrlSchemeHandlers().value(canonicalScheme) != handler)
-            qWarning("URL scheme handler already installed for the scheme: %s", scheme.constData());
+    if (!d->profileAdapter()->addCustomUrlSchemeHandler(scheme, handler))
         return;
-    }
-
-    if (QWebEngineUrlScheme::schemeByName(canonicalScheme) == QWebEngineUrlScheme())
-        qWarning("Please register the custom scheme '%s' via QWebEngineUrlScheme::registerScheme() "
-                 "before installing the custom scheme handler.", scheme.constData());
-
-    d->profileAdapter()->addCustomUrlSchemeHandler(canonicalScheme, handler);
     connect(handler, SIGNAL(_q_destroyedUrlSchemeHandler(QWebEngineUrlSchemeHandler*)), this, SLOT(destroyedUrlSchemeHandler(QWebEngineUrlSchemeHandler*)));
 }