From 8cacf53ade0871ee3e5874cbf2b8c0b92f9ca407 Mon Sep 17 00:00:00 2001
From: Yoshisato Yanagisawa <yyanagisawa@chromium.org>
Date: Fri, 18 Sep 2026 12:13:51 -0700
Subject: [PATCH] Validate dropped URI schemes in LocationBarDragDropHandler

Ensure that direct URI items dropped onto the location bar are
verified to have a content or file scheme before resolving MIME types
or applying fallback clip descriptions. Previously, items with other
URI schemes could be accepted if the clip description matched
acceptable MIME types.

Additionally, use case-insensitive comparisons for URI schemes and
catch exceptions that may arise when querying the content resolver for
MIME types.

Fixed: 541604102
Change-Id: Ib7fc268979af9ccc6feff55864899da00ea3e4e9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8429467
Auto-Submit: Tomasz Wiszkowski <ender@google.com>
Commit-Queue: Tomasz Wiszkowski <ender@google.com>
Reviewed-by: Sky Malice <skym@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1701009}
---
diff --git a/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/LocationBarDragDropHandler.java b/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/LocationBarDragDropHandler.java
index 2e4bf6e..96fd4f0 100644
--- a/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/LocationBarDragDropHandler.java
+++ b/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/LocationBarDragDropHandler.java
@@ -115,7 +115,7 @@
 
             String url = uriToLoad.toString();
             if (permissions != null
-                    && ContentResolver.SCHEME_CONTENT.equals(uriToLoad.getScheme())) {
+                    && ContentResolver.SCHEME_CONTENT.equalsIgnoreCase(uriToLoad.getScheme())) {
                 tab.addObserver(new DragAndDropPermissionsReleaseObserver(tab, permissions));
                 permissions = null;
             }
@@ -159,10 +159,14 @@
     @VisibleForTesting
     @Nullable
     String getMimeType(Context context, Uri uri) {
-        if (ContentResolver.SCHEME_CONTENT.equals(uri.getScheme())) {
-            return context.getContentResolver().getType(uri);
+        if (ContentResolver.SCHEME_CONTENT.equalsIgnoreCase(uri.getScheme())) {
+            try {
+                return context.getContentResolver().getType(uri);
+            } catch (Exception e) {
+                return null;
+            }
         }
-        if (!ContentResolver.SCHEME_FILE.equals(uri.getScheme())) {
+        if (!ContentResolver.SCHEME_FILE.equalsIgnoreCase(uri.getScheme())) {
             return null;
         }
         String extension = MimeTypeMap.getFileExtensionFromUrl(uri.toString());
@@ -204,7 +208,7 @@
     boolean hasContentUri(ClipData clipData) {
         for (int i = 0; i < clipData.getItemCount(); i++) {
             Uri uri = clipData.getItemAt(i).getUri();
-            if (uri != null && ContentResolver.SCHEME_CONTENT.equals(uri.getScheme())) {
+            if (uri != null && ContentResolver.SCHEME_CONTENT.equalsIgnoreCase(uri.getScheme())) {
                 return true;
             }
         }
@@ -212,6 +216,20 @@
     }
 
     /**
+     * Checks if the URI has a content or file scheme (case-insensitive).
+     *
+     * @param uri The URI to check.
+     * @return True if the URI has a content or file scheme, false otherwise.
+     */
+    @VisibleForTesting
+    boolean isContentOrFileUri(@Nullable Uri uri) {
+        if (uri == null) return false;
+        String scheme = uri.getScheme();
+        return ContentResolver.SCHEME_CONTENT.equalsIgnoreCase(scheme)
+                || ContentResolver.SCHEME_FILE.equalsIgnoreCase(scheme);
+    }
+
+    /**
      * Finds the first acceptable URI in the clip data to load. If the clip data contains a single
      * item and its mime type cannot be determined from the URI, it falls back to checking the clip
      * description.
@@ -240,7 +258,7 @@
             }
 
             Uri uri = item.getUri();
-            if (uri == null) continue;
+            if (uri == null || !isContentOrFileUri(uri)) continue;
 
             String mimeType = getMimeType(context, uri);
             if (mimeType == null && clipData.getItemCount() == 1 && desc != null) {
diff --git a/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/LocationBarDragDropHandlerUnitTest.java b/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/LocationBarDragDropHandlerUnitTest.java
index 0b808f6..a198cdf 100644
--- a/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/LocationBarDragDropHandlerUnitTest.java
+++ b/chrome/browser/ui/android/omnibox/java/src/org/chromium/chrome/browser/omnibox/LocationBarDragDropHandlerUnitTest.java
@@ -51,6 +51,7 @@
 import org.chromium.url.GURL;
 
 import java.lang.ref.WeakReference;
+import java.util.List;
 
 /** Unit tests for {@link LocationBarDragDropHandler}. */
 @RunWith(BaseRobolectricTestRunner.class)
@@ -253,6 +254,21 @@
     }
 
     @Test
+    public void testIsContentOrFileUri() {
+        assertTrue(mHandler.isContentOrFileUri(Uri.parse("content://com.example/doc")));
+        assertTrue(mHandler.isContentOrFileUri(Uri.parse("CONTENT://com.example/doc")));
+        assertTrue(mHandler.isContentOrFileUri(Uri.parse("file:///path/to/file.txt")));
+        assertTrue(mHandler.isContentOrFileUri(Uri.parse("FILE:///path/to/file.txt")));
+        assertFalse(mHandler.isContentOrFileUri(Uri.parse("http://example.com")));
+        assertFalse(mHandler.isContentOrFileUri(Uri.parse("https://example.com")));
+        assertFalse(mHandler.isContentOrFileUri(Uri.parse("javascript:alert(1)")));
+        assertFalse(mHandler.isContentOrFileUri(Uri.parse("data:text/html,sample_data")));
+        assertFalse(mHandler.isContentOrFileUri(Uri.parse("chrome://flags")));
+        assertFalse(mHandler.isContentOrFileUri(null));
+        assertFalse(mHandler.isContentOrFileUri(Uri.EMPTY));
+    }
+
+    @Test
     public void testGetMimeType() {
         // Content URI
         Uri contentUri = Uri.parse("content://com.example.provider/doc");
@@ -431,4 +447,182 @@
 
         assertNull(mHandler.findUriToLoad(mContext, clipData, null));
     }
+
+    @Test
+    public void testFindUriToLoad_RejectsJavascriptUriWithFallbackMimeType() {
+        Uri uri = Uri.parse("javascript:alert(1)");
+        ClipData clipData =
+                new ClipData("url", new String[] {"text/plain"}, new ClipData.Item(uri));
+        ClipDescription desc = new ClipDescription("url", new String[] {"text/plain"});
+
+        assertNull(mHandler.findUriToLoad(mContext, clipData, desc));
+    }
+
+    @Test
+    public void testOnDrag_Drop_JavascriptUri_Rejected() {
+        Uri uri = Uri.parse("javascript:alert(1)");
+        ClipData clipData =
+                new ClipData("url", new String[] {"text/plain"}, new ClipData.Item(uri));
+
+        when(mDragEvent.getAction()).thenReturn(DragEvent.ACTION_DROP);
+        when(mDragEvent.getClipData()).thenReturn(clipData);
+        when(mDragEvent.getClipDescription()).thenReturn(clipData.getDescription());
+        when(mWindowAndroid.getActivity()).thenReturn(new WeakReference<>(mActivity));
+
+        assertFalse(mHandler.onDrag(new View(mContext), mDragEvent));
+        verify(mOmniboxStub, never()).loadUrl(any());
+    }
+
+    @Test
+    public void testFindUriToLoad_RejectsDataUri() {
+        Uri uri = Uri.parse("data:text/html,sample_data");
+        ClipData clipData =
+                new ClipData("data", new String[] {"text/html"}, new ClipData.Item(uri));
+        ClipDescription desc = new ClipDescription("data", new String[] {"text/html"});
+
+        assertNull(mHandler.findUriToLoad(mContext, clipData, desc));
+    }
+
+    @Test
+    public void testFindUriToLoad_RejectsChromeAndAboutSchemes() {
+        for (String urlStr :
+                List.of(
+                        "chrome://flags",
+                        "chrome-native://bookmarks",
+                        "about:blank",
+                        "about:flags")) {
+            Uri uri = Uri.parse(urlStr);
+            ClipData clipData =
+                    new ClipData("internal", new String[] {"text/plain"}, new ClipData.Item(uri));
+            ClipDescription desc = new ClipDescription("internal", new String[] {"text/plain"});
+
+            assertNull(
+                    "Scheme should be rejected: " + urlStr,
+                    mHandler.findUriToLoad(mContext, clipData, desc));
+        }
+    }
+
+    @Test
+    public void testFindUriToLoad_RejectsOtherDisallowedSchemes() {
+        for (String urlStr :
+                List.of(
+                        "jar:file:///path.jar!/file.txt",
+                        "blob:https://example.com/sample",
+                        "intent:#Intent;action=VIEW;end")) {
+            Uri uri = Uri.parse(urlStr);
+            ClipData clipData =
+                    new ClipData("disallowed", new String[] {"text/plain"}, new ClipData.Item(uri));
+            ClipDescription desc = new ClipDescription("disallowed", new String[] {"text/plain"});
+
+            assertNull(
+                    "Scheme should be rejected: " + urlStr,
+                    mHandler.findUriToLoad(mContext, clipData, desc));
+        }
+    }
+
+    @Test
+    public void testFindUriToLoad_RejectsUppercaseJavascriptUri() {
+        Uri uri = Uri.parse("JAVASCRIPT:alert(1)");
+        ClipData clipData =
+                new ClipData("url", new String[] {"text/plain"}, new ClipData.Item(uri));
+        ClipDescription desc = new ClipDescription("url", new String[] {"text/plain"});
+
+        assertNull(mHandler.findUriToLoad(mContext, clipData, desc));
+    }
+
+    @Test
+    public void testOnDrag_Drop_UppercaseContentUri_AcceptedWithPermissions() {
+        Uri contentUri = Uri.parse("CONTENT://com.example.provider/document.pdf");
+        ClipData clipData =
+                new ClipData(
+                        "doc", new String[] {"application/pdf"}, new ClipData.Item(contentUri));
+        when(mDragEvent.getAction()).thenReturn(DragEvent.ACTION_DROP);
+        when(mDragEvent.getClipData()).thenReturn(clipData);
+        when(mDragEvent.getClipDescription()).thenReturn(clipData.getDescription());
+        when(mWindowAndroid.getActivity()).thenReturn(new WeakReference<>(mActivity));
+        when(mActivity.requestDragAndDropPermissions(mDragEvent))
+                .thenReturn(mDragAndDropPermissions);
+
+        assertTrue(mHandler.onDrag(new View(mContext), mDragEvent));
+        verify(mTab).addObserver(any());
+        verify(mOmniboxStub).loadUrl(mLoadUrlParamsCaptor.capture());
+        assertEquals(
+                "CONTENT://com.example.provider/document.pdf", mLoadUrlParamsCaptor.getValue().url);
+    }
+
+    @Test
+    public void testOnDrag_Drop_UppercaseFileUri_Accepted() {
+        Uri fileUri = Uri.parse("FILE:///path/to/file.txt");
+        ClipData clipData =
+                new ClipData("file", new String[] {"text/plain"}, new ClipData.Item(fileUri));
+
+        when(mDragEvent.getAction()).thenReturn(DragEvent.ACTION_DROP);
+        when(mDragEvent.getClipData()).thenReturn(clipData);
+        when(mDragEvent.getClipDescription()).thenReturn(clipData.getDescription());
+        when(mWindowAndroid.getActivity()).thenReturn(new WeakReference<>(mActivity));
+
+        assertTrue(mHandler.onDrag(new View(mContext), mDragEvent));
+        verify(mOmniboxStub).loadUrl(mLoadUrlParamsCaptor.capture());
+        assertEquals("FILE:///path/to/file.txt", mLoadUrlParamsCaptor.getValue().url);
+    }
+
+    @Test
+    public void testOnDrag_Drop_SkipsUnsupportedUriScheme() {
+        Uri fileUri = Uri.parse("file:///path/to/file.txt");
+        ClipData clipData =
+                new ClipData(
+                        "text",
+                        new String[] {"text/plain"},
+                        new ClipData.Item(Uri.parse("javascript:alert(1)")));
+        clipData.addItem(new ClipData.Item(fileUri));
+
+        when(mDragEvent.getAction()).thenReturn(DragEvent.ACTION_DROP);
+        when(mDragEvent.getClipData()).thenReturn(clipData);
+        when(mDragEvent.getClipDescription()).thenReturn(clipData.getDescription());
+        when(mWindowAndroid.getActivity()).thenReturn(new WeakReference<>(mActivity));
+
+        assertTrue(mHandler.onDrag(new View(mContext), mDragEvent));
+        verify(mOmniboxStub).loadUrl(mLoadUrlParamsCaptor.capture());
+        assertEquals("file:///path/to/file.txt", mLoadUrlParamsCaptor.getValue().url);
+    }
+
+    @Test
+    public void testFindUriToLoad_FallbackMimeTypeOnlyForContentOrFile() {
+        // Content URI with null getType() -> Uses fallback -> Accepted
+        Uri contentUri = Uri.parse("content://com.example.provider/sample");
+        when(mContentProvider.getType(contentUri)).thenReturn(null);
+        ShadowContentResolver.registerProviderInternal("com.example.provider", mContentProvider);
+        ClipData contentClip =
+                new ClipData(
+                        "doc", new String[] {"application/pdf"}, new ClipData.Item(contentUri));
+        assertEquals(
+                contentUri,
+                mHandler.findUriToLoad(mContext, contentClip, contentClip.getDescription()));
+
+        // File URI with no extension -> Uses fallback -> Accepted
+        Uri fileUri = Uri.parse("file:///path/to/no_extension_file");
+        ClipData fileClip =
+                new ClipData("file", new String[] {"text/plain"}, new ClipData.Item(fileUri));
+        assertEquals(
+                fileUri, mHandler.findUriToLoad(mContext, fileClip, fileClip.getDescription()));
+
+        // Non-content/file URI with null getMimeType() -> Fallback blocked -> Rejected
+        Uri jsUri = Uri.parse("javascript:alert(1)");
+        ClipData jsClip = new ClipData("js", new String[] {"text/plain"}, new ClipData.Item(jsUri));
+        assertNull(mHandler.findUriToLoad(mContext, jsClip, jsClip.getDescription()));
+    }
+
+    @Test
+    public void testFindUriToLoad_RejectsSchemelessOrMalformedUri() {
+        for (String urlStr : List.of("//example.com", "relative/path/file.txt", "   ")) {
+            Uri uri = Uri.parse(urlStr);
+            ClipData clipData =
+                    new ClipData("malformed", new String[] {"text/plain"}, new ClipData.Item(uri));
+            ClipDescription desc = new ClipDescription("malformed", new String[] {"text/plain"});
+
+            assertNull(
+                    "Schemeless/malformed URI should be rejected: " + urlStr,
+                    mHandler.findUriToLoad(mContext, clipData, desc));
+        }
+    }
 }