Bug 1433179 - Add ReferrerUrl and HostUrl to the Zone.Information stream. r=paolo

Differential Revision: https://phabricator.services.mozilla.com/D21829

--HG--
extra : moz-landing-system : lando

toolkit/components/downloads/DownloadIntegration.jsm

@@ -458,6 +458,41 @@ var DownloadIntegration = {
     }
   },
 
+  /**
+   * Builds a key and URL value pair for the "Zone.Identifier" Alternate Data
+   * Stream.
+   *
+   * @param aKey
+   *        String to write before the "=" sign. This is not validated.
+   * @param aUrl
+   *        URL string to write after the "=" sign. Only the "http(s)" and
+   *        "ftp" schemes are allowed, and usernames and passwords are
+   *        stripped.
+   * @param [optional] aFallback
+   *        Value to place after the "=" sign in case the URL scheme is not
+   *        allowed. If unspecified, an empty string is returned when the
+   *        scheme is not allowed.
+   *
+   * @return Line to add to the stream, including the final CRLF, or an empty
+   *         string if the validation failed.
+   */
+  _zoneIdKey(aKey, aUrl, aFallback) {
+    try {
+      let url;
+      const uri = NetUtil.newURI(aUrl);
+      if (["http", "https", "ftp"].includes(uri.scheme)) {
+        url = uri.mutate().setUserPass("").finalize().spec;
+      } else if (aFallback) {
+        url = aFallback;
+      } else {
+        return "";
+      }
+      return aKey + "=" + url + "\r\n";
+    } catch (e) {
+      return "";
+    }
+  },
+
   /**
    * Performs platform-specific operations when a download is done.
    *
@@ -497,7 +532,13 @@ var DownloadIntegration = {
             { winAllowLengthBeyondMaxPathWithCaveats: true }
           );
           try {
-            await stream.write(new TextEncoder().encode("[ZoneTransfer]\r\nZoneId=" + zone + "\r\n"));
+            let zoneId = "[ZoneTransfer]\r\nZoneId=" + zone + "\r\n";
+            if (!aDownload.source.isPrivate) {
+              zoneId +=
+                this._zoneIdKey("ReferrerUrl", aDownload.source.referrer) +
+                this._zoneIdKey("HostUrl", aDownload.source.url, "about:internet");
+            }
+            await stream.write(new TextEncoder().encode(zoneId));
           } finally {
             await stream.close();
           }

toolkit/components/downloads/test/unit/common_test_Download.js

@@ -354,16 +354,52 @@ add_task(async function test_windows_zoneInformation() {
                                          ["T".repeat(256) + ".txt"]);
   longTargetFile.createUnique(Ci.nsIFile.NORMAL_FILE_TYPE, 0o600);
 
-  for (let targetFile of [normalTargetFile, longTargetFile]) {
+  const httpSourceUrl = httpUrl("source.txt");
+  const dataSourceUrl = "data:text/html," + TEST_DATA_SHORT;
+  const tests = [
+    { expectedZoneId: "[ZoneTransfer]\r\nZoneId=3\r\n" +
+                      "HostUrl=" + httpSourceUrl + "\r\n" },
+    { targetFile: longTargetFile,
+      expectedZoneId: "[ZoneTransfer]\r\nZoneId=3\r\n" +
+                      "HostUrl=" + httpSourceUrl + "\r\n" },
+    { sourceUrl: dataSourceUrl,
+      expectedZoneId: "[ZoneTransfer]\r\nZoneId=3\r\n" +
+                      "HostUrl=about:internet\r\n" },
+    { options: { referrer: TEST_REFERRER_URL },
+      expectedZoneId: "[ZoneTransfer]\r\nZoneId=3\r\n" +
+                      "ReferrerUrl=" + TEST_REFERRER_URL + "\r\n" +
+                      "HostUrl=" + httpSourceUrl + "\r\n" },
+    { options: { referrer: dataSourceUrl },
+      expectedZoneId: "[ZoneTransfer]\r\nZoneId=3\r\n" +
+                      "HostUrl=" + httpSourceUrl + "\r\n" },
+    { options: { referrer: "http://example.com/a\rb\nc" },
+      expectedZoneId: "[ZoneTransfer]\r\nZoneId=3\r\n" +
+                      "ReferrerUrl=http://example.com/abc\r\n" +
+                      "HostUrl=" + httpSourceUrl + "\r\n" },
+    { options: { referrer: "ftp://user:pass@example.com/" },
+      expectedZoneId: "[ZoneTransfer]\r\nZoneId=3\r\n" +
+                      "ReferrerUrl=ftp://example.com/\r\n" +
+                      "HostUrl=" + httpSourceUrl + "\r\n" },
+    { options: { isPrivate: true },
+      expectedZoneId: "[ZoneTransfer]\r\nZoneId=3\r\n" },
+    { options: { referrer: TEST_REFERRER_URL, isPrivate: true },
+      expectedZoneId: "[ZoneTransfer]\r\nZoneId=3\r\n" },
+  ];
+  for (const test of tests) {
+    const sourceUrl = test.sourceUrl || httpSourceUrl;
+    const targetFile = test.targetFile || normalTargetFile;
+    info(targetFile.path);
     try {
       if (!gUseLegacySaver) {
         let download = await Downloads.createDownload({
-          source: httpUrl("source.txt"),
+          source: test.options ? Object.assign({ url: sourceUrl }, test.options)
+                               : sourceUrl,
           target: targetFile.path,
         });
         await download.start();
       } else {
-        let download = await promiseStartLegacyDownload(null, { targetFile });
+        let download = await promiseStartLegacyDownload(sourceUrl,
+          Object.assign({ targetFile }, test.options || {}));
         await promiseDownloadStopped(download);
       }
       await promiseVerifyContents(targetFile.path, TEST_DATA_SHORT);
@@ -373,7 +409,7 @@ add_task(async function test_windows_zoneInformation() {
                  { winAllowLengthBeyondMaxPathWithCaveats: true });
       try {
         Assert.equal(new TextDecoder().decode(await file.read()),
-                     "[ZoneTransfer]\r\nZoneId=3\r\n");
+                     test.expectedZoneId);
       } finally {
         file.close();
       }