From eae11b9a9a448d4089fa1be4b32a9aa77669c9cb Mon Sep 17 00:00:00 2001
From: David Rosca <nowrep@gmail.com>
Date: Sat, 27 Jan 2018 12:31:39 +0100
Subject: [PATCH] LocationBar: Only allow whitelisted schemes to be loaded as
 url

---
 autotests/locationbartest.cpp      | 10 +++++++---
 src/lib/navigation/locationbar.cpp | 15 +++++++++++----
 2 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/autotests/locationbartest.cpp b/autotests/locationbartest.cpp
index 81de2ef57..b24d38b48 100644
--- a/autotests/locationbartest.cpp
+++ b/autotests/locationbartest.cpp
@@ -128,7 +128,7 @@ void LocationBarTest::loadActionSearchTest()
 
 void LocationBarTest::loadAction_kdebug389491()
 {
-    // "site:website.com searchterm" is loaded instead of searched
+    // "site:website.com searchterm" and "link:website.com" are loaded instead of searched
 
     SearchEngine engine;
     engine.name = "Test Engine";
@@ -143,9 +143,13 @@ void LocationBarTest::loadAction_kdebug389491()
     QCOMPARE(action.type, LocationBar::LoadAction::Search);
     QCOMPARE(action.loadRequest.url(), QUrl("http://test/site%3Awebsite.com%20searchterm"));
 
-    action = LocationBar::loadAction("site:website.com?search=searchterm and another");
+    action = LocationBar::loadAction("link:website.com");
+    QCOMPARE(action.type, LocationBar::LoadAction::Search);
+    QCOMPARE(action.loadRequest.url(), QUrl("http://test/link%3Awebsite.com"));
+
+    action = LocationBar::loadAction("http://website.com?search=searchterm and another");
     QCOMPARE(action.type, LocationBar::LoadAction::Url);
-    QCOMPARE(action.loadRequest.url(), QUrl("site:website.com?search=searchterm and another"));
+    QCOMPARE(action.loadRequest.url(), QUrl("http://website.com?search=searchterm and another"));
 }
 
 FALKONTEST_MAIN(LocationBarTest)
diff --git a/src/lib/navigation/locationbar.cpp b/src/lib/navigation/locationbar.cpp
index e43130002..66010883e 100644
--- a/src/lib/navigation/locationbar.cpp
+++ b/src/lib/navigation/locationbar.cpp
@@ -263,11 +263,18 @@ LocationBar::LoadAction LocationBar::loadAction(const QString &text)
     // Otherwise load as url
     const QUrl &guessedUrl = QUrl::fromUserInput(t);
     if (guessedUrl.isValid()) {
-        // We only allow space in query
+        // Only allow spaces in query
         if (!QzTools::containsSpace(guessedUrl.toString(QUrl::RemoveQuery))) {
-            action.type = LoadAction::Url;
-            action.loadRequest = guessedUrl;
-            return action;
+            // Only allow whitelisted schemes
+            const QSet<QString> whitelistedSchemes = {
+                QSL("http"), QSL("https"), QSL("ftp"), QSL("file"),
+                QSL("about"), QSL("qupzilla")
+            };
+            if (whitelistedSchemes.contains(guessedUrl.scheme())) {
+                action.type = LoadAction::Url;
+                action.loadRequest = guessedUrl;
+                return action;
+            }
         }
     }