diff --git a/ios/chrome/browser/reading_list/model/reading_list_distiller_page.mm b/ios/chrome/browser/reading_list/model/reading_list_distiller_page.mm --- a/ios/chrome/browser/reading_list/model/reading_list_distiller_page.mm +++ b/ios/chrome/browser/reading_list/model/reading_list_distiller_page.mm @@ -239,10 +239,11 @@ bool ReadingListDistillerPage::IsGoogleCachedAMPPage() { if (!url.is_valid() || !url.SchemeIs(url::kHttpsScheme)) { return false; } + // GURL::path() includes the leading '/', so compare against "/amp/". if (!google_util::IsGoogleDomainUrl( url, google_util::DISALLOW_SUBDOMAIN, google_util::DISALLOW_NON_STANDARD_PORTS) || - !url.GetPath().compare(0, 4, "amp/")) { + url.path().compare(0, 5, "/amp/") != 0) { return false; } const web::SSLStatus& ssl_status = CurrentWebState() @@ -279,7 +280,9 @@ void ReadingListDistillerPage::OnHandleGoogleCachedAMPPageResult( NSError* error) { if (!error && value->is_string()) { GURL new_gurl(value->GetString()); - if (new_gurl.is_valid()) { + // The URL is sourced from page-world JavaScript on the AMP cache page. + // Restrict the follow-up navigation to web schemes. + if (new_gurl.is_valid() && new_gurl.SchemeIsHTTPOrHTTPS()) { FetchFavicon(new_gurl); web::NavigationManager::WebLoadParams params(new_gurl); CurrentWebState()->GetNavigationManager()->LoadURLWithParams(params);