From 3a5751cee142e1fae5a8eeccb7e4b5f07a8b4170 Mon Sep 17 00:00:00 2001
From: Federica Germinario <[email protected]>
Date: Tue, 26 May 2026 02:42:45 -0700
Subject: [PATCH] [ios] Restrict Siri Shortcut intents to HTTP and HTTPS schemes

This CL adds scheme validation to URLs extracted from Siri Shortcut
intents (OpenInChromeIntent and OpenInChromeIncognitoIntent).
Previously, these intents did not validate schemes. Now, only valid
URLs with HTTP or HTTPS schemes are processed, and others are filtered
out.

This fix is applied to both the legacy UserActivityBrowserAgent and the
modernized TaskRequestForUserActivity flows.

Fixed: 503779807
Change-Id: I496fcaaf79215d914d2aafe8ecbcd94dbe89e463
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7867540
Commit-Queue: Mark Cogan <[email protected]>
Auto-Submit: Federica Germinario <[email protected]>
Reviewed-by: Mark Cogan <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1636014}
---

diff --git a/ios/chrome/app/task_request_user_activity.mm b/ios/chrome/app/task_request_user_activity.mm
index 1c733c1..6777d5b 100644
--- a/ios/chrome/app/task_request_user_activity.mm
+++ b/ios/chrome/app/task_request_user_activity.mm
@@ -525,7 +525,8 @@
   std::vector<GURL> urls;
   urls.reserve(intent_urls.count);
   for (NSURL* intent_url in intent_urls) {
-    if (GURL url = net::GURLWithNSURL(intent_url); url.is_valid()) {
+    if (GURL url = net::GURLWithNSURL(intent_url);
+        url.is_valid() && url.SchemeIsHTTPOrHTTPS()) {
       urls.push_back(std::move(url));
     }
   }
diff --git a/ios/chrome/browser/intents/model/user_activity_browser_agent.mm b/ios/chrome/browser/intents/model/user_activity_browser_agent.mm
index f4d59950..e4797bc 100644
--- a/ios/chrome/browser/intents/model/user_activity_browser_agent.mm
+++ b/ios/chrome/browser/intents/model/user_activity_browser_agent.mm
@@ -68,7 +68,10 @@
 std::vector<GURL> CreateGURLVectorFromIntentURLs(NSArray<NSURL*>* intent_urls) {
   std::vector<GURL> urls;
   for (NSURL* url in intent_urls) {
-    urls.push_back(net::GURLWithNSURL(url));
+    GURL gurl = net::GURLWithNSURL(url);
+    if (gurl.is_valid() && gurl.SchemeIsHTTPOrHTTPS()) {
+      urls.push_back(gurl);
+    }
   }
   return urls;
 }