From 3098962882ad76e8fcd3f4d5cc714c0918aad7cc Mon Sep 17 00:00:00 2001
From: Olivier Robin <olivierrobin@google.com>
Date: Tue, 28 Apr 2026 07:32:06 -0700
Subject: [PATCH] Remove spaces from QR code scan

Sanitize spaces from QR code scaner results
- Replace all whitespace characters with spaces
- Remove duplicate spaces
- Remove leading and trailing spaces

Bug: 505290253
Change-Id: Ib8b121734475e8e8c61a627d34b631e4ab6bbc71
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7796322
Auto-Submit: Olivier Robin <olivierrobin@chromium.org>
Reviewed-by: Quentin Pubert <qpubert@google.com>
Commit-Queue: Olivier Robin <olivierrobin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1621749}
---

diff --git a/ios/chrome/browser/qr_scanner/test/qr_scanner_view_controller_egtest.mm b/ios/chrome/browser/qr_scanner/test/qr_scanner_view_controller_egtest.mm
index 8999bd8..8b0db1e 100644
--- a/ios/chrome/browser/qr_scanner/test/qr_scanner_view_controller_egtest.mm
+++ b/ios/chrome/browser/qr_scanner/test/qr_scanner_view_controller_egtest.mm
@@ -705,4 +705,23 @@
               sanitizedResult:kTestSanitizedDataURL];
 }
 
+// Test that whitespace is trimmed and duplicate spaces are removed.
+- (void)testQueryWhitespaceSanitized {
+  [self doTestReceivingResult:" \t a \n b  " sanitizedResult:"a b"];
+}
+
+// Test that whitespace is trimmed from URLs.
+- (void)testURLWhitespaceTrimmed {
+  std::string input = " \t\u3000 " + _testURL.spec() + " \n ";
+  [self doTestReceivingResult:input
+              sanitizedResult:"\"" + _testURL.spec() + "\""];
+}
+
+// Test that whitespace is trimmed from not http/https URLs and quotes are
+// added.
+- (void)testDataURLWhitespaceTrimmed {
+  std::string input = " \t\u3000 " + std::string(kTestDataURL) + " \n ";
+  [self doTestReceivingResult:input sanitizedResult:kTestSanitizedDataURL];
+}
+
 @end
diff --git a/ios/chrome/browser/qr_scanner/ui/qr_scanner_view_controller.mm b/ios/chrome/browser/qr_scanner/ui/qr_scanner_view_controller.mm
index 4d3cbbc..d5da302b 100644
--- a/ios/chrome/browser/qr_scanner/ui/qr_scanner_view_controller.mm
+++ b/ios/chrome/browser/qr_scanner/ui/qr_scanner_view_controller.mm
@@ -68,12 +68,12 @@
 
 #pragma mark - QRScannerCameraControllerDelegate
 
-- (void)receiveQRScannerResult:(NSString*)result loadImmediately:(BOOL)load {
-  result = [self sanitizedStringWithString:result];
-
+- (void)receiveQRScannerResult:(NSString*)rawResult loadImmediately:(BOOL)load {
+  NSString* result = [self sanitizedStringWithString:rawResult];
+  BOOL sanitized = ![result isEqualToString:rawResult];
   GURL url = GURL(base::SysNSStringToUTF8(result));
-  if (url.is_valid() && !url.SchemeIsHTTPOrHTTPS()) {
-    // Only HTTP(S) URLs are supported.
+  if (url.is_valid() && (!url.SchemeIsHTTPOrHTTPS() || sanitized)) {
+    // Only unmodified HTTP(S) URLs are supported.
     // For other URLs, add quotes so they are considered as search terms instead
     // of URLs.
     result = [NSString stringWithFormat:@"\"%@\"", result];
@@ -133,6 +133,11 @@
 
 // Remove characters that might confuse users when originating from a QR code.
 - (NSString*)sanitizedStringWithString:(NSString*)string {
+  if (!string) {
+    return @"";
+  }
+
+  // Remove control, newline, non-base, and illegal characters.
   NSMutableCharacterSet* badCharacters =
       [NSMutableCharacterSet controlCharacterSet];
   [badCharacters
@@ -141,8 +146,19 @@
       formUnionWithCharacterSet:[NSCharacterSet nonBaseCharacterSet]];
   [badCharacters
       formUnionWithCharacterSet:[NSCharacterSet illegalCharacterSet]];
-  return [[string componentsSeparatedByCharactersInSet:badCharacters]
-      componentsJoinedByString:@""];
+
+  NSString* cleaned =
+      [[string componentsSeparatedByCharactersInSet:badCharacters]
+          componentsJoinedByString:@""];
+
+  // Replace whitespace with spaces, trim, and remove duplicates.
+  NSArray* components =
+      [cleaned componentsSeparatedByCharactersInSet:
+                   [NSCharacterSet whitespaceAndNewlineCharacterSet]];
+  NSPredicate* predicate = [NSPredicate predicateWithFormat:@"SELF != ''"];
+  NSArray* filteredComponents =
+      [components filteredArrayUsingPredicate:predicate];
+  return [filteredComponents componentsJoinedByString:@" "];
 }
 
 #pragma mark - Testing Additions

diff --git a/ios/chrome/browser/qr_scanner/test/qr_scanner_view_controller_egtest.mm b/ios/chrome/browser/qr_scanner/test/qr_scanner_view_controller_egtest.mm
index 8999bd8..8b0db1e 100644
--- a/ios/chrome/browser/qr_scanner/test/qr_scanner_view_controller_egtest.mm
+++ b/ios/chrome/browser/qr_scanner/test/qr_scanner_view_controller_egtest.mm
@@ -705,4 +705,23 @@
               sanitizedResult:kTestSanitizedDataURL];
 }
 
+// Test that whitespace is trimmed and duplicate spaces are removed.
+- (void)testQueryWhitespaceSanitized {
+  [self doTestReceivingResult:" \t a \n b  " sanitizedResult:"a b"];
+}
+
+// Test that whitespace is trimmed from URLs.
+- (void)testURLWhitespaceTrimmed {
+  std::string input = " \t\u3000 " + _testURL.spec() + " \n ";
+  [self doTestReceivingResult:input
+              sanitizedResult:"\"" + _testURL.spec() + "\""];
+}
+
+// Test that whitespace is trimmed from not http/https URLs and quotes are
+// added.
+- (void)testDataURLWhitespaceTrimmed {
+  std::string input = " \t\u3000 " + std::string(kTestDataURL) + " \n ";
+  [self doTestReceivingResult:input sanitizedResult:kTestSanitizedDataURL];
+}
+
 @end