commit 35ee7ff74b4650d7d54634d64c71e5182b085841
author = <patilmayur@microsoft.com> Wed May 28 16:36:13 2025
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> Wed May 28 16:36:13 2025
tree 0b8cf5501089c2b463424fa0fbb65cf8f3a694d9
parent 07e5f17e711b7154cae5f295516c40f84e52fe34

Domain Validation: Reject leading dots in non special urls

This PR addresses a crash reported by the net_canonical_cookie_fuzzer
related to the GetCookieDomainWithString method in Chromium. The issue
occurs when a URL like o://%2e is passed with an empty domain string.

On Windows, this URL is treated as a special URL (scheme: file), where
On Linux, it is treated as a non-special URL, leading to inconsistent
behavior.

During the domain canonicalization process, %2e is decoded to a dot (.),
and a leading dot causes domain parsing to fail in the DomainIsHostOnly
method.

To resolve this, the proposed solution is to explicitly reject leading
dots in non-special URLs during domain validation. This change ensures
consistent behavior across platforms and prevents malformed domain
inputs from causing crashes.

Bug: 403967933

Change-Id: Ie0c53f8037fbec2de15cc15ef08a1af607bfe4a9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6553452
Reviewed-by: Dylan Cutler <dylancutler@google.com>
Reviewed-by: Chris Fredrickson <cfredric@chromium.org>
Commit-Queue: Mayur Patil <patilmayur@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#1466536}