Make eww handle "http://a/../../../g"

* lisp/net/eww.el (eww): Strip leading elements off URLs on the
form "http://a/../../../g", because that's what all the other
browsers do (bug#8622).

diff --git a/lisp/net/eww.el b/lisp/net/eww.el
index 49bf10d4ebe47bcc235e05a353d5292010a01070..f73718961208876c85d64fb040a25baad4e7b19d 100644 (file)
--- a/lisp/net/eww.el
+++ b/lisp/net/eww.el
@@ -269,8 +269,13 @@ word(s) will be searched for via `eww-search-prefix'."
   (let ((parsed (url-generic-parse-url url)))
     (when (url-host parsed)
       (unless (puny-highly-restrictive-domain-p (url-host parsed))
-        (setf (url-host parsed) (puny-encode-domain (url-host parsed)))
-        (setq url (url-recreate-url parsed)))))
+        (setf (url-host parsed) (puny-encode-domain (url-host parsed)))))
+    ;; When the URL is on the form "http://a/../../../g", chop off all
+    ;; the leading "/.."s.
+    (when (url-filename parsed)
+      (while (string-match "\\`/[.][.]/" (url-filename parsed))
+        (setf (url-filename parsed) (substring (url-filename parsed) 3))))
+    (setq url (url-recreate-url parsed)))
   (plist-put eww-data :url url)
   (plist-put eww-data :title "")
   (eww-update-header-line-format)