URLPattern: Throw on more illegal hostname code points.

As discussed in the mozilla standards-position issue on URLPattern:

mozilla/standards-positions#566

There are a number of URL encoding interop issues between browsers.
Since URLPattern delegates to the URL parser for canonicalization it
is also exposed to these interop issues.

While fixing all of URL's interop issues is orthogonal to shipping
URLPattern, we can at least prevent clearly illegal code points from
being used in URLPattern.  This will avoid increasing usage of these
code points which will in turn make it slightly easier to fix the issue
in the URL parser in the future.

Bug: 1248061
Change-Id: I58a55e4206004a6cba727f19d537c5929ce16d43
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3152036
Reviewed-by: Jeremy Roman <jbroman@chromium.org>
Commit-Queue: Ben Kelly <wanderview@chromium.org>
Cr-Commit-Position: refs/heads/main@{#920223}
NOKEYCHECK=True
GitOrigin-RevId: 70a691d8a4840ab2ac989031d207b42834a80482

blink/renderer/modules/url_pattern/url_pattern_canon.cc

@@ -39,6 +39,22 @@ std::string StdStringFromCanonOutput(const url::CanonOutput& output,
   return std::string(output.data() + component.begin, component.len);
 }
 
+bool ContainsForbiddenHostnameCodePoint(absl::string_view input) {
+  for (auto c : input) {
+    // The full list of forbidden code points is defined at:
+    //
+    //  https://url.spec.whatwg.org/#forbidden-host-code-point
+    //
+    // We only check the code points the chromium URL parser incorrectly
+    // permits.  See: crbug.com/1065667#c18
+    if (c == ' ' || c == '#' || c == ':' || c == '<' || c == '>' || c == '@' ||
+        c == '[' || c == ']' || c == '|') {
+      return true;
+    }
+  }
+  return false;
+}
+
 }  // anonymous namespace
 
 absl::StatusOr<std::string> ProtocolEncodeCallback(absl::string_view input) {
@@ -106,6 +122,18 @@ absl::StatusOr<std::string> HostnameEncodeCallback(absl::string_view input) {
   if (input.empty())
     return std::string();
 
+  // Due to crbug.com/1065667 the url::CanonicalizeHost() call below will
+  // permit and possibly encode some illegal code points.  Since we want
+  // to ultimately fix that in the future we don't want to encourage more
+  // use of these characters in URLPattern.  Therefore we apply an additional
+  // restrictive check for these forbidden code points.
+  //
+  // TODO(crbug.com/1065667): Remove this check after the URL parser is fixed.
+  if (ContainsForbiddenHostnameCodePoint(input)) {
+    return absl::InvalidArgumentError("Invalid hostname pattern '" +
+                                      std::string(input) + "'.");
+  }
+
   url::RawCanonOutputT<char> canon_output;
   url::Component component;
 

blink/web_tests/external/wpt/urlpattern/resources/urlpatterntestdata.json

@@ -2359,5 +2359,73 @@
     "expected_match": {
       "protocol": { "input": "foobar", "groups": { "name": "foobar" }}
     }
+  },
+  {
+    "pattern": [{ "hostname": "bad hostname" }],
+    "expected_obj": "error"
+  },
+  {
+    "pattern": [{ "hostname": "bad#hostname" }],
+    "expected_obj": "error"
+  },
+  {
+    "pattern": [{ "hostname": "bad%hostname" }],
+    "expected_obj": "error"
+  },
+  {
+    "pattern": [{ "hostname": "bad/hostname" }],
+    "expected_obj": "error"
+  },
+  {
+    "pattern": [{ "hostname": "bad\\:hostname" }],
+    "expected_obj": "error"
+  },
+  {
+    "pattern": [{ "hostname": "bad<hostname" }],
+    "expected_obj": "error"
+  },
+  {
+    "pattern": [{ "hostname": "bad>hostname" }],
+    "expected_obj": "error"
+  },
+  {
+    "pattern": [{ "hostname": "bad?hostname" }],
+    "expected_obj": "error"
+  },
+  {
+    "pattern": [{ "hostname": "bad@hostname" }],
+    "expected_obj": "error"
+  },
+  {
+    "pattern": [{ "hostname": "bad[hostname" }],
+    "expected_obj": "error"
+  },
+  {
+    "pattern": [{ "hostname": "bad]hostname" }],
+    "expected_obj": "error"
+  },
+  {
+    "pattern": [{ "hostname": "bad\\\\hostname" }],
+    "expected_obj": "error"
+  },
+  {
+    "pattern": [{ "hostname": "bad^hostname" }],
+    "expected_obj": "error"
+  },
+  {
+    "pattern": [{ "hostname": "bad|hostname" }],
+    "expected_obj": "error"
+  },
+  {
+    "pattern": [{ "hostname": "bad\nhostname" }],
+    "expected_obj": "error"
+  },
+  {
+    "pattern": [{ "hostname": "bad\rhostname" }],
+    "expected_obj": "error"
+  },
+  {
+    "pattern": [{ "hostname": "bad\thostname" }],
+    "expected_obj": "error"
   }
 ]