From e2fe46065ab3a3be9b7256ba2c100fabf316b1ad Mon Sep 17 00:00:00 2001 From: Idan Horowitz Date: Tue, 5 Aug 2025 00:01:21 +0300 Subject: [PATCH] LibWeb: Remove extraneous trailing '/' from service worker script scope MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The spec language specifies 'Set maxScopeString to "/", followed by the strings in XXXX’s path (including empty strings), separated from each other by "/"': That is, adjacent components are separated by a '/', but the last component does not get a trailing '/'. This resulted in the generated scope string ending with '//' in some cases, incorrectly tripping the 'Service-Worker-Allowed' security check --- Libraries/LibWeb/ServiceWorker/Job.cpp | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/Libraries/LibWeb/ServiceWorker/Job.cpp b/Libraries/LibWeb/ServiceWorker/Job.cpp index 267d1a178cc..f616c6c44b3 100644 --- a/Libraries/LibWeb/ServiceWorker/Job.cpp +++ b/Libraries/LibWeb/ServiceWorker/Job.cpp @@ -289,10 +289,7 @@ static void update(JS::VM& vm, GC::Ref job) auto join_paths_with_slash = [](URL::URL const& url) -> ByteString { StringBuilder builder; builder.append('/'); - for (auto const& component : url.paths()) { - builder.append(component); - builder.append('/'); - } + builder.join('/', url.paths()); return builder.to_byte_string(); };