WebView: relax URLUtil#isFileUrl()
This relaxes URLUtil#isFileUrl() to accept a prefix of "file:" instead
of requiring "file://". Chromium treats "file:path" as if the user had
typed "file:///path". An app may incorrectly believe it's safe to load
anything that URLUtil#isFileUrl() rejects, intending to refuse all URLs
which point to the file system.
Bug: 72848579
Test: cts-tradefed run cts -m CtsWebkitTestCases -t android.webkit.cts.URLUtilTest#testIsFileUrl
Change-Id: I7b3bba961523d4bdda6169a0f50fe7f1d1579e38
diff --git a/core/java/android/webkit/URLUtil.java b/core/java/android/webkit/URLUtil.java
index 84c000a..ed122a6 100644
--- a/core/java/android/webkit/URLUtil.java
+++ b/core/java/android/webkit/URLUtil.java
@@ -39,7 +39,7 @@
// "file:///android_res/drawable/bar.png". Use "drawable" to refer to
// "drawable-hdpi" directory as well.
static final String RESOURCE_BASE = "file:///android_res/";
- static final String FILE_BASE = "file://";
+ static final String FILE_BASE = "file:";
static final String PROXY_BASE = "file:///cookieless_proxy/";
static final String CONTENT_BASE = "content:";