[Network] Escape external protocol handler URLs

2 files changed, 26 insertions, 16 deletions

diff --git a/uriloader/exthandler/nsExternalHelperAppService.cpp b/uriloader/exthandler/nsExternalHelperAppService.cpp
index e3e135b053..02a555f04c 100644
--- a/uriloader/exthandler/nsExternalHelperAppService.cpp
+++ b/uriloader/exthandler/nsExternalHelperAppService.cpp
@@ -1,5 +1,4 @@
 /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*-
- * vim:expandtab:shiftwidth=2:tabstop=2:cin:
  * This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
@@ -851,6 +850,25 @@ NS_IMETHODIMP nsExternalHelperAppService::LoadUrl(nsIURI * aURL)
 static const char kExternalProtocolPrefPrefix[]  = "network.protocol-handler.external.";
 static const char kExternalProtocolDefaultPref[] = "network.protocol-handler.external-default";
 
+// static
+nsresult nsExternalHelperAppService::EscapeURI(nsIURI* aURI, nsIURI** aResult) {
+  MOZ_ASSERT(aURI);
+  MOZ_ASSERT(aResult);
+
+  nsAutoCString spec;
+  aURI->GetSpec(spec);
+
+  if (spec.Find("%00") != -1) return NS_ERROR_MALFORMED_URI;
+
+  nsAutoCString escapedSpec;
+  nsresult rv = NS_EscapeURL(spec, esc_AlwaysCopy | esc_ExtHandler, escapedSpec,
+                             fallible);
+  NS_ENSURE_SUCCESS(rv, rv);
+
+  nsCOMPtr<nsIIOService> ios(do_GetIOService());
+  return ios->NewURI(escapedSpec, nullptr, nullptr, aResult);
+}
+
 NS_IMETHODIMP 
 nsExternalHelperAppService::LoadURI(nsIURI *aURI,
                                     nsIInterfaceRequestor *aWindowContext)
@@ -867,22 +885,12 @@ nsExternalHelperAppService::LoadURI(nsIURI *aURI,
     return NS_OK;
   }
 
-  nsAutoCString spec;
-  aURI->GetSpec(spec);
-
-  if (spec.Find("%00") != -1)
-    return NS_ERROR_MALFORMED_URI;
-
-  spec.ReplaceSubstring("\"", "%22");
-  spec.ReplaceSubstring("`", "%60");
-  
-  nsCOMPtr<nsIIOService> ios(do_GetIOService());
-  nsCOMPtr<nsIURI> uri;
-  nsresult rv = ios->NewURI(spec, nullptr, nullptr, getter_AddRefs(uri));
+  nsCOMPtr<nsIURI> escapedURI;
+  nsresult rv = EscapeURI(aURI, getter_AddRefs(escapedURI));
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsAutoCString scheme;
-  uri->GetScheme(scheme);
+  escapedURI->GetScheme(scheme);
   if (scheme.IsEmpty())
     return NS_OK; // must have a scheme
 
@@ -915,13 +923,13 @@ nsExternalHelperAppService::LoadURI(nsIURI *aURI,
   // a helper app or the system default, we just launch the URI.
   if (!alwaysAsk && (preferredAction == nsIHandlerInfo::useHelperApp ||
                      preferredAction == nsIHandlerInfo::useSystemDefault))
-    return handler->LaunchWithURI(uri, aWindowContext);
+    return handler->LaunchWithURI(escapedURI, aWindowContext);
   
   nsCOMPtr<nsIContentDispatchChooser> chooser =
     do_CreateInstance("@mozilla.org/content-dispatch-chooser;1", &rv);
   NS_ENSURE_SUCCESS(rv, rv);
   
-  return chooser->Ask(handler, aWindowContext, uri,
+  return chooser->Ask(handler, aWindowContext, escapedURI,
                       nsIContentDispatchChooser::REASON_CANNOT_HANDLE);
 }
 
diff --git a/uriloader/exthandler/nsExternalHelperAppService.h b/uriloader/exthandler/nsExternalHelperAppService.h
index ceec66661d..13dcbb7122 100644
--- a/uriloader/exthandler/nsExternalHelperAppService.h
+++ b/uriloader/exthandler/nsExternalHelperAppService.h
@@ -198,6 +198,8 @@ private:
                                          bool aForceSave,
                                          nsIInterfaceRequestor *aWindowContext,
                                          nsIStreamListener ** aStreamListener);
+
+  static nsresult EscapeURI(nsIURI* aURI, nsIURI** aResult);
 };
 
 /**