From 553969206ce9e85d4f11dbe4756ddcfd1366e731 Mon Sep 17 00:00:00 2001
From: Ameen <[email protected]>
Date: Tue, 22 Jul 2025 16:33:11 +0530
Subject: [PATCH] [DevTools] Sanitize special whitespace in "Copy as cURL (cmd)"

The escapeStringWin function did not properly sanitize special
whitespace characters (e.g., tabs, vertical tabs), which are
treated as delimiters by the Windows command prompt.

This change sanitizes all whitespace characters (other than normal space), which closes the vulnerability.

Bug: 427367145
Change-Id: If1f1be803a4b4a20a93b6982247eaf9cbebaf6ce
Reviewed-on: https://chromium-review.googlesource.com/c/devtools/devtools-frontend/+/6746171
Reviewed-by: Simon Zünd <[email protected]>
Commit-Queue: Simon Zünd <[email protected]>
Reviewed-by: Danil Somsikov <[email protected]>
Commit-Queue: Danil Somsikov <[email protected]>
---

diff --git a/AUTHORS b/AUTHORS
index 2de9dac..7061bb3 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -16,6 +16,7 @@
 Alesandro Ortiz <[email protected]>
 Alexander Stammbach <[email protected]>
 Alexey Rodionov <[email protected]>
+Ameen Basha <[email protected]>
 Ankit Mishra <[email protected]>
 Anna Agoha <[email protected]>
 Anthony Xie <[email protected]>
diff --git a/front_end/panels/network/NetworkLogView.ts b/front_end/panels/network/NetworkLogView.ts
index e44d26f..27d1648 100644
--- a/front_end/panels/network/NetworkLogView.ts
+++ b/front_end/panels/network/NetworkLogView.ts
@@ -2337,6 +2337,7 @@
               .replace(/"/g, '\\"')
               .replace(/[^a-zA-Z0-9\s_\-:=+~'\/.',?;()*`]/g, '^$&')
               .replace(/%(?=[a-zA-Z0-9_])/g, '%^')
+              .replace(/[^\S \r\n]/g, '^$&')
               .replace(/\r?\n|\r/g, '^\n\n') +
           encapsChars;
     }