LocationBar: Only allow whitelisted schemes to be loaded as url

autotests/locationbartest.cpp

@@ -128,7 +128,7 @@ void LocationBarTest::loadActionSearchTest()
 
 void LocationBarTest::loadAction_kdebug389491()
 {
-    // "site:website.com searchterm" is loaded instead of searched
+    // "site:website.com searchterm" and "link:website.com" are loaded instead of searched
 
     SearchEngine engine;
     engine.name = "Test Engine";
@@ -143,9 +143,13 @@ void LocationBarTest::loadAction_kdebug389491()
     QCOMPARE(action.type, LocationBar::LoadAction::Search);
     QCOMPARE(action.loadRequest.url(), QUrl("http://test/site%3Awebsite.com%20searchterm"));
 
-    action = LocationBar::loadAction("site:website.com?search=searchterm and another");
+    action = LocationBar::loadAction("link:website.com");
+    QCOMPARE(action.type, LocationBar::LoadAction::Search);
+    QCOMPARE(action.loadRequest.url(), QUrl("http://test/link%3Awebsite.com"));
+
+    action = LocationBar::loadAction("http://website.com?search=searchterm and another");
     QCOMPARE(action.type, LocationBar::LoadAction::Url);
-    QCOMPARE(action.loadRequest.url(), QUrl("site:website.com?search=searchterm and another"));
+    QCOMPARE(action.loadRequest.url(), QUrl("http://website.com?search=searchterm and another"));
 }
 
 FALKONTEST_MAIN(LocationBarTest)

src/lib/navigation/locationbar.cpp

@@ -263,11 +263,18 @@ LocationBar::LoadAction LocationBar::loadAction(const QString &text)
     // Otherwise load as url
     const QUrl &guessedUrl = QUrl::fromUserInput(t);
     if (guessedUrl.isValid()) {
-        // We only allow space in query
+        // Only allow spaces in query
         if (!QzTools::containsSpace(guessedUrl.toString(QUrl::RemoveQuery))) {
-            action.type = LoadAction::Url;
-            action.loadRequest = guessedUrl;
-            return action;
+            // Only allow whitelisted schemes
+            const QSet<QString> whitelistedSchemes = {
+                QSL("http"), QSL("https"), QSL("ftp"), QSL("file"),
+                QSL("about"), QSL("qupzilla")
+            };
+            if (whitelistedSchemes.contains(guessedUrl.scheme())) {
+                action.type = LoadAction::Url;
+                action.loadRequest = guessedUrl;
+                return action;
+            }
         }
     }