LibWeb: Remove extraneous trailing '/' from service worker script scope
Some checks are pending
CI / macOS, arm64, Sanitizer, Clang (push) Waiting to run
CI / Linux, x86_64, Fuzzers, Clang (push) Waiting to run
CI / Linux, x86_64, Sanitizer, GNU (push) Waiting to run
CI / Linux, x86_64, Sanitizer, Clang (push) Waiting to run
Package the js repl as a binary artifact / Linux, arm64 (push) Waiting to run
Package the js repl as a binary artifact / macOS, arm64 (push) Waiting to run
Package the js repl as a binary artifact / Linux, x86_64 (push) Waiting to run
Run test262 and test-wasm / run_and_update_results (push) Waiting to run
Lint Code / lint (push) Waiting to run
Label PRs with merge conflicts / auto-labeler (push) Waiting to run
Push notes / build (push) Waiting to run

The spec language specifies 'Set maxScopeString to "/", followed by the
strings in XXXX’s path (including empty strings), separated from each
other by "/"': That is, adjacent components are separated by a '/', but
the last component does not get a trailing '/'.

This resulted in the generated scope string ending with '//' in some
cases, incorrectly tripping the 'Service-Worker-Allowed' security check
This commit is contained in:
Idan Horowitz 2025-08-05 00:01:21 +03:00 committed by Jelle Raaijmakers
commit e2fe46065a
Notes: github-actions[bot] 2025-08-04 22:39:03 +00:00

View file

@ -289,10 +289,7 @@ static void update(JS::VM& vm, GC::Ref<Job> job)
auto join_paths_with_slash = [](URL::URL const& url) -> ByteString {
StringBuilder builder;
builder.append('/');
for (auto const& component : url.paths()) {
builder.append(component);
builder.append('/');
}
builder.join('/', url.paths());
return builder.to_byte_string();
};