From 57f01d9195a83c45266cf9145f0facefeea9d56e Mon Sep 17 00:00:00 2001
From: Torne (Richard Coles) <[email protected]>
Date: Fri, 17 Jul 2026 09:05:58 -0700
Subject: [PATCH] webview: Reject ambiguous ':' in WebAddressParser

WebAddressParser's PORT regex accepted a ':' followed by zero digits,
silently dropping it. If no scheme was recognised the colon may have been
intended to be part of a scheme delimiter, and dropping it may change the
interpretation of the URL's host.

Instead, throw URISyntaxException when PORT matched a bare ':' and no scheme
was recognised.

Update WebAddressParserTest; several existing "bad input" test cases now throw,
and add some new cases for unrecognized schemes.

Fixed: 517167020
Change-Id: I090927d8dca336a915c6103ba258c7b65110fb01
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8118007
Reviewed-by: Peter Pakkenberg <[email protected]>
Auto-Submit: Richard Coles <[email protected]>
Commit-Queue: Peter Pakkenberg <[email protected]>
Commit-Queue: Richard Coles <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1663937}
---

diff --git a/android_webview/java/src/org/chromium/android_webview/WebAddressParser.java b/android_webview/java/src/org/chromium/android_webview/WebAddressParser.java
index b53c87bb..5fab0f33 100644
--- a/android_webview/java/src/org/chromium/android_webview/WebAddressParser.java
+++ b/android_webview/java/src/org/chromium/android_webview/WebAddressParser.java
@@ -77,12 +77,22 @@
             t = m.group(MATCH_GROUP_HOST);
             if (t != null) mHost = t;
             t = m.group(MATCH_GROUP_PORT);
-            if (t != null && t.length() > 0) {
+            if (t != null) {
                 // The ':' character is not returned by the regex.
-                try {
-                    mPort = Integer.parseInt(t);
-                } catch (NumberFormatException ex) {
-                    throw new URISyntaxException(address, "Bad port");
+                if (t.length() == 0) {
+                    // PORT matched a bare ':' with no digits. If no scheme was
+                    // recognised, the ':' may have been a scheme delimiter and
+                    // mHost may not actually be the host, so reject the input
+                    // rather than risk emitting a URL with the wrong host.
+                    if (mScheme.isEmpty()) {
+                        throw new URISyntaxException(address, "Bad port");
+                    }
+                } else {
+                    try {
+                        mPort = Integer.parseInt(t);
+                    } catch (NumberFormatException ex) {
+                        throw new URISyntaxException(address, "Bad port");
+                    }
                 }
             }
             t = m.group(MATCH_GROUP_PATH);
diff --git a/android_webview/junit/src/org/chromium/android_webview/robolectric/WebAddressParserTest.java b/android_webview/junit/src/org/chromium/android_webview/robolectric/WebAddressParserTest.java
index 5e54c91..b8478f5 100644
--- a/android_webview/junit/src/org/chromium/android_webview/robolectric/WebAddressParserTest.java
+++ b/android_webview/junit/src/org/chromium/android_webview/robolectric/WebAddressParserTest.java
@@ -97,13 +97,6 @@
         Assert.assertEquals("http:///.some.domain", fixupUrl(".some.domain"));
         Assert.assertEquals("http:///.some.domain", fixupUrl("http://.some.domain"));
 
-        Assert.assertEquals("http://www.example.com/-1", fixupUrl("www.example.com:-1"));
-        Assert.assertEquals(
-                "http:///www.example.com@@example.com:80",
-                fixupUrl(":www.example.com@@example.com:80"));
-        Assert.assertEquals(
-                "http://rtsp//www.example.com/media.mp4",
-                fixupUrl("rtsp://www.example.com/media.mp4"));
         Assert.assertEquals("http:///^", fixupUrl("^"));
         Assert.assertEquals("http:///.", fixupUrl("."));
         Assert.assertEquals("http:///", fixupUrl(""));
@@ -113,16 +106,26 @@
     @SmallTest
     @Feature({"AndroidWebView", "Privacy"})
     public void testInputWithURISyntaxException() {
-        try {
-            fixupUrl("www.example.com:1234567890123");
-            Assert.fail("Bad port should throw an exception");
-        } catch (URISyntaxException e) {
-        }
+        assertBadAddress("www.example.com:1234567890123");
+
+        // A ':' that isn't followed by a port number and isn't preceded by a recognised scheme
+        // is rejected, since it may have been intended as a scheme delimiter and the parser
+        // can't determine the host with confidence.
+        assertBadAddress("www.example.com:-1");
+        assertBadAddress(":www.example.com@@example.com:80");
+        assertBadAddress("rtsp://www.example.com/media.mp4");
+        assertBadAddress("foo.example.com://bar.example.com/");
+        assertBadAddress("foo.example.com://[email protected]/");
+        assertBadAddress("a.example.com://b.example.com/path");
 
         // Because the ANCHOR regex matches everything, WebAddressParser won't throw exception
         // because of no matching.
     }
 
+    private void assertBadAddress(String url) {
+        Assert.assertThrows(URISyntaxException.class, () -> fixupUrl(url));
+    }
+
     private String fixupUrl(String url) throws URISyntaxException {
         return new WebAddressParser(url).toString();
     }