Issue 4395 - Setting page is loaded non-populated on some systems

src/shared/Utils.cpp

 /*
  * This file is part of Adblock Plus <https://adblockplus.org/>,
  * Copyright (C) 2006-2016 Eyeo GmbH
  *
  * Adblock Plus is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
  * published by the Free Software Foundation.
  *
  * Adblock Plus is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with Adblock Plus.  If not, see <http://www.gnu.org/licenses/>.
  */
 
 #include <memory>
 #include <stdexcept>
 #include <vector>
 
 #include <Windows.h>
 #include <ShlObj.h>
 #include <Shlwapi.h>
+#include <WinInet.h>
 
 #include "Utils.h"
 
 namespace
 {
   // See http://blogs.msdn.com/b/oldnewthing/archive/2004/10/25/247180.aspx
   EXTERN_C IMAGE_DOS_HEADER __ImageBase;
 
   std::wstring appDataPath;
 
@@ skipping 166 matching lines @@
   auto endQueryStringPos = url.find(L'#', queryStringBeginsAt);
   if (endQueryStringPos == std::wstring::npos)
   {
     endQueryStringPos = url.length();
   }
   return url.substr(queryStringBeginsAt, endQueryStringPos - queryStringBeginsAt);
 }
 
 std::wstring CanonicalizeUrl(const std::wstring& url)
 {
-  std::wstring urlCanonicalized;
-  urlCanonicalized.resize(url.length() * 2);

[Eric, 2016/09/07 16:50:53]

Canonicalization can add escape sequences, so sizing the byte buffer based only
on the input string can/will lead to buffer overflows.

[Oleksandr, 2016/09/08 02:51:15]

Done.

-  DWORD urlSize = urlCanonicalized.length();
-  UrlCanonicalizeW(url.c_str(), &urlCanonicalized[0], &urlSize, 0); 

[Eric, 2016/09/07 16:50:53]

You can call this function with argument 'dwFlags' = URL_UNESCAPE to collapse
the substring "%20" to " ". (As well as any other unsafe URL characters that are
legal in path names.)

That should be sufficient to create a canonical URL for comparison.

Or we can just use the old function.

[Eric, 2016/09/07 16:50:53]

Need to verify the return value here, just in case.

[Oleksandr, 2016/09/08 02:51:15]

Done.

[Oleksandr, 2016/09/08 02:51:15]

Done.

-  urlCanonicalized.resize(urlSize);
-  return urlCanonicalized;
-}
-
-std::wstring EscapeUrl(const std::wstring& url)

[Eric, 2016/09/07 16:50:53]

If we don't compare using escaped URL forms, we don't need this function at all.

[Oleksandr, 2016/09/08 02:51:15]

Done.

-{
-  std::wstring urlEscaped;
-  urlEscaped.resize(url.length() * 2);
-  DWORD urlSize = urlEscaped.length();
-  UrlEscapeW(url.c_str(), &urlEscaped[0], &urlSize, 0); 
-  urlEscaped.resize(urlSize);
-  return urlEscaped;
-}
-
+  std::wstring urlCanonical;
+  DWORD urlSize = INTERNET_MAX_URL_LENGTH;
+  urlCanonical.resize(urlSize);
+  if ((UrlCanonicalizeW(url.c_str(), &urlCanonical[0], &urlSize, URL_UNESCAPE) != S_OK) || (urlSize <= 0))
+    return L"";
+  urlCanonical.resize(urlSize);
+  return urlCanonical;
+}