Merge "Don\'t pass URL path and username/password to PAC scripts" into klp-dev

am: af0b4466ff

* commit 'af0b4466ffe2ed09b288014d1d3a9ed308fe3c76':
  Don't pass URL path and username/password to PAC scripts

Change-Id: I8a49a29ed1999ab811d3306dc46769d83c05244e

1 files changed, 9 insertions, 0 deletions

diff --git a/core/java/android/net/PacProxySelector.java b/core/java/android/net/PacProxySelector.java
index 8a2c2b6c675f..ce7b337bb9af 100644
--- a/core/java/android/net/PacProxySelector.java
+++ b/core/java/android/net/PacProxySelector.java
@@ -31,6 +31,7 @@ import java.net.Proxy.Type;
 import java.net.ProxySelector;
 import java.net.SocketAddress;
 import java.net.URI;
+import java.net.URISyntaxException;
 import java.util.List;
 
 /**
@@ -65,7 +66,15 @@ public class PacProxySelector extends ProxySelector {
         String response = null;
         String urlString;
         try {
+            // Strip path and username/password from URI so it's not visible to PAC script. The
+            // path often contains credentials the app does not want exposed to a potentially
+            // malicious PAC script.
+            if (!"http".equalsIgnoreCase(uri.getScheme())) {
+                uri = new URI(uri.getScheme(), null, uri.getHost(), uri.getPort(), "/", null, null);
+            }
             urlString = uri.toURL().toString();
+        } catch (URISyntaxException e) {
+            urlString = uri.getHost();
         } catch (MalformedURLException e) {
             urlString = uri.getHost();
         }