commit ae9f0d82faf57a14f3d1790394844b3739f16501
author Kiran Ramachandra <kiranmr@google.com> Fri Jun 21 16:58:29 2024 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Fri Jun 21 16:58:29 2024 +0000
tree 94c71a4fb943560a1330b04f7b610ca9c60c52b3
parent fc8940b312cb2dfc190fecbcb0d1878a996ede30
parent 91fd430a8d83e37f1bf1840d127a6513973a5372

DO NOT MERGE Ignore - Sanitized uri scheme by removing scheme delimiter am: 841ce92aa1 am: 91fd430a8d

Original change: https://googleplex-android-review.googlesource.com/c/platform/frameworks/base/+/27632412

Change-Id: I97761aed46aaaa7e67e32fea4938c52b99637f9e
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

core/java/android/net/Uri.java

diff --git a/core/java/android/net/Uri.java b/core/java/android/net/Uri.java
index 3da696a..f0262e9 100644
--- a/core/java/android/net/Uri.java
+++ b/core/java/android/net/Uri.java
@@ -1388,7 +1388,11 @@
          * @param scheme name or {@code null} if this is a relative Uri
          */
         public Builder scheme(String scheme) {
-            this.scheme = scheme;
+            if (scheme != null) {
+                this.scheme = scheme.replace("://", "");
+            } else {
+                this.scheme = null;
+            }
             return this;
         }
 

core/tests/coretests/src/android/net/UriTest.java

diff --git a/core/tests/coretests/src/android/net/UriTest.java b/core/tests/coretests/src/android/net/UriTest.java
index 89632a4..fd12e51 100644
--- a/core/tests/coretests/src/android/net/UriTest.java
+++ b/core/tests/coretests/src/android/net/UriTest.java
@@ -18,6 +18,7 @@
 
 import android.content.ContentUris;
 import android.os.Parcel;
+import android.platform.test.annotations.AsbSecurityTest;
 
 import androidx.test.filters.SmallTest;
 
@@ -88,6 +89,16 @@
         assertNull(u.getHost());
     }
 
+    @AsbSecurityTest(cveBugId = 261721900)
+    @SmallTest
+    public void testSchemeSanitization() {
+        Uri uri = new Uri.Builder()
+                .scheme("http://https://evil.com:/te:st/")
+                .authority("google.com").path("one/way").build();
+        assertEquals("httphttpsevil.com:/te:st/", uri.getScheme());
+        assertEquals("httphttpsevil.com:/te:st/://google.com/one/way", uri.toString());
+    }
+
     @SmallTest
     public void testStringUri() {
         assertEquals("bob lee",