Tighten definition of what's accepted as a URI, to exclude some potentially malicious ones

3 files changed, 12 insertions, 5 deletions

diff --git a/core/src/test/java/com/google/zxing/client/result/CalendarParsedResultTestCase.java b/core/src/test/java/com/google/zxing/client/result/CalendarParsedResultTestCase.java
index e81f10979..2b7910727 100644
--- a/core/src/test/java/com/google/zxing/client/result/CalendarParsedResultTestCase.java
+++ b/core/src/test/java/com/google/zxing/client/result/CalendarParsedResultTestCase.java
@@ -146,7 +146,7 @@ public final class CalendarParsedResultTestCase extends Assert {
         "GEO:-12.345\r\n" +
         "END:VEVENT\r\nEND:VCALENDAR", null, null, BarcodeFormat.QR_CODE);
     ParsedResult result = ResultParser.parseResult(fakeResult);
-    assertSame(ParsedResultType.URI, result.getType());
+    assertSame(ParsedResultType.TEXT, result.getType());
   }
 
   @Test
diff --git a/core/src/test/java/com/google/zxing/client/result/ParsedReaderResultTestCase.java b/core/src/test/java/com/google/zxing/client/result/ParsedReaderResultTestCase.java
index e8d6020b6..024c201fa 100644
--- a/core/src/test/java/com/google/zxing/client/result/ParsedReaderResultTestCase.java
+++ b/core/src/test/java/com/google/zxing/client/result/ParsedReaderResultTestCase.java
@@ -238,7 +238,7 @@ public final class ParsedReaderResultTestCase extends Assert {
     doTestResult("BEGIN:VEVENT\r\nSUMMARY:foo\r\nDTSTART:20080504\r\nEND:VEVENT",
         "foo\n" + formatDate(2008, 5, 4), ParsedResultType.CALENDAR);
     doTestResult("BEGIN:VEVENT\r\nDTEND:20080505T\r\nEND:VEVENT",
-        "BEGIN:VEVENT\r\nDTEND:20080505T\r\nEND:VEVENT", ParsedResultType.URI);
+        "BEGIN:VEVENT\r\nDTEND:20080505T\r\nEND:VEVENT", ParsedResultType.TEXT);
     // Yeah, it's OK that this is thought of as maybe a URI as long as it's not CALENDAR
     // Make sure illegal entries without newlines don't crash
     doTestResult(
diff --git a/core/src/test/java/com/google/zxing/client/result/URIParsedResultTestCase.java b/core/src/test/java/com/google/zxing/client/result/URIParsedResultTestCase.java
index 0a7e43c1b..b5af83e50 100644
--- a/core/src/test/java/com/google/zxing/client/result/URIParsedResultTestCase.java
+++ b/core/src/test/java/com/google/zxing/client/result/URIParsedResultTestCase.java
@@ -94,6 +94,12 @@ public final class URIParsedResultTestCase extends Assert {
   }
 
   @Test
+  public void testMaliciousUnicode() {
+    doTestIsPossiblyMalicious("https://google.com\u2215.evil.com/stuff", true);
+    doTestIsPossiblyMalicious("\u202ehttps://dylankatz.com/moc.elgoog.www//:sptth", true);
+  }
+
+  @Test
   public void testExotic() {
     doTest("bitcoin:mySD89iqpmptrK3PhHFW9fa7BXiP7ANy3Y", "bitcoin:mySD89iqpmptrK3PhHFW9fa7BXiP7ANy3Y", null);
     doTest("BTCTX:-TC4TO3$ZYZTC5NC83/SYOV+YGUGK:$BSF0P8/STNTKTKS.V84+JSA$LB+EHCG+8A725.2AZ-NAVX3VBV5K4MH7UL2.2M:" +
@@ -124,9 +130,10 @@ public final class URIParsedResultTestCase extends Assert {
     assertEquals(text, result.getDisplayResult());
   }
 
-  private static void doTestIsPossiblyMalicious(String uri, boolean expected) {
-    URIParsedResult result = new URIParsedResult(uri, null);
-    assertEquals(expected, result.isPossiblyMaliciousURI());
+  private static void doTestIsPossiblyMalicious(String uri, boolean malicious) {
+    Result fakeResult = new Result(uri, null, null, BarcodeFormat.QR_CODE);
+    ParsedResult result = ResultParser.parseResult(fakeResult);
+    assertSame(malicious ? ParsedResultType.TEXT : ParsedResultType.URI, result.getType());
   }
 
 }
\ No newline at end of file