1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-06-08 05:27:14 +09:00
ladybird/Libraries/LibWebView/SearchEngine.cpp
Timothy Flynn dbf4b189a4 LibWebView: Do not use AK::format to format search engine URLs
This is to prepare for custom search engines. If we use AK::format, it
would be trivial for a user (or bad actor) to come up with a template
search engine URL that ultimately crashes the browser due to internal
assertions in AK::format. For example:

    https://example.com/crash={1}

Rather than coming up with a complicated pre-format validator, let's
just not use AK::format. Custom URLs will signify their template query
parameters with "%s". So we can do the same with our built-in engines.
When it comes time to format the URL, we will do a simple string
replacement.
2025-04-06 13:45:10 +02:00

54 lines
1.7 KiB
C++

/*
* Copyright (c) 2023-2025, Tim Flynn <trflynn89@ladybird.org>
*
* SPDX-License-Identifier: BSD-2-Clause
*/
#include <AK/Find.h>
#include <LibURL/URL.h>
#include <LibWebView/SearchEngine.h>
namespace WebView {
static auto builtin_search_engines = to_array<SearchEngine>({
{ "Bing"_string, "https://www.bing.com/search?q=%s"_string },
{ "Brave"_string, "https://search.brave.com/search?q=%s"_string },
{ "DuckDuckGo"_string, "https://duckduckgo.com/?q=%s"_string },
{ "Ecosia"_string, "https://ecosia.org/search?q=%s"_string },
{ "Google"_string, "https://www.google.com/search?q=%s"_string },
{ "Kagi"_string, "https://kagi.com/search?q=%s"_string },
{ "Mojeek"_string, "https://www.mojeek.com/search?q=%s"_string },
{ "Startpage"_string, "https://startpage.com/search?q=%s"_string },
{ "Yahoo"_string, "https://search.yahoo.com/search?p=%s"_string },
{ "Yandex"_string, "https://yandex.com/search/?text=%s"_string },
});
ReadonlySpan<SearchEngine> search_engines()
{
return builtin_search_engines;
}
Optional<SearchEngine> find_search_engine_by_name(StringView name)
{
return find_value(builtin_search_engines, [&](auto const& engine) {
return engine.name == name;
});
}
String SearchEngine::format_search_query_for_display(StringView query) const
{
static constexpr auto MAX_SEARCH_STRING_LENGTH = 32;
return MUST(String::formatted("Search {} for \"{:.{}}{}\"",
name,
query,
MAX_SEARCH_STRING_LENGTH,
query.length() > MAX_SEARCH_STRING_LENGTH ? "..."sv : ""sv));
}
String SearchEngine::format_search_query_for_navigation(StringView query) const
{
return MUST(query_url.replace("%s"sv, URL::percent_encode(query), ReplaceMode::All));
}
}