From c383f0b3e53fdb7f9fa613409df57c1b71a8483a Mon Sep 17 00:00:00 2001
From: "dveditz%cruzio.com"
 <dveditz%cruzio.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Sat, 2 Feb 2008 19:50:09 +0000
Subject: [PATCH] bug 415338 (follow-on to bug 413250) don't scan query parts
 of chrome URIs to not break addons (as inspired by similar Seamonkey
 regression) . r/sr=neil, a=mtscrehp

git-svn-id: svn://10.0.0.236/trunk@244794 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/chrome/src/nsChromeRegistry.cpp | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/mozilla/chrome/src/nsChromeRegistry.cpp b/mozilla/chrome/src/nsChromeRegistry.cpp
index 3dc16d5790f..c95156d8df2 100644
--- a/mozilla/chrome/src/nsChromeRegistry.cpp
+++ b/mozilla/chrome/src/nsChromeRegistry.cpp
@@ -681,24 +681,29 @@ nsChromeRegistry::Canonify(nsIURL* aChromeURL)
   else {
     // prevent directory traversals ("..")
     // path is already unescaped once, but uris can get unescaped twice
-    const char* curChar = path.BeginReading();
+    const char* pos = path.BeginReading();
     const char* end = path.EndReading();
-    while (curChar < end) {
-      switch (*curChar) {
+    while (pos < end) {
+      switch (*pos) {
         case ':':
           return NS_ERROR_DOM_BAD_URI;
         case '.':
-          if (*(curChar+1) == '.')
+          if (pos[1] == '.')
             return NS_ERROR_DOM_BAD_URI;
+          break;
         case '%':
           // chrome: URIs with double-escapes are trying to trick us.
           // watch for %2e, and %25 in case someone triple unescapes
-          if (*(curChar+1) == '2' &&
-               ( *(curChar+2) == 'e' || *(curChar+2) == 'E' || 
-                 *(curChar+2) == '5' ))
+          if (pos[1] == '2' &&
+               ( pos[2] == 'e' || pos[2] == 'E' || 
+                 pos[2] == '5' ))
             return NS_ERROR_DOM_BAD_URI;
+          break;
+        case '?':
+          pos = end;
+          continue;
       }
-      ++curChar;
+      ++pos;
     }
   }