1 files changed, 25 insertions, 1 deletions
diff --git a/toolkit/components/url-classifier/nsUrlClassifierUtils.cpp b/toolkit/components/url-classifier/nsUrlClassifierUtils.cpp
index da5e9cd451..6a329830d6 100644
--- a/toolkit/components/url-classifier/nsUrlClassifierUtils.cpp
+++ b/toolkit/components/url-classifier/nsUrlClassifierUtils.cpp
@@ -293,7 +293,12 @@ nsUrlClassifierUtils::GetKeyForURI(nsIURI* uri, nsACString& _retval) {
     rv = innerURI->GetQuery(query);
     NS_ENSURE_SUCCESS(rv, rv);
 
-    _retval.AppendPrintf("?%s", query.get());
+    // We have to canonicalize the query too based on
+    // https://developers.google.com/safe-browsing/v4/urls-hashing?hl=en#canonicalization
+    rv = CanonicalizeQuery(query, temp);
+    NS_ENSURE_SUCCESS(rv, rv);
+
+    _retval.Append(temp);
   }
 
   return NS_OK;
@@ -917,6 +922,25 @@ nsresult nsUrlClassifierUtils::CanonicalizePath(const nsACString& path,
   return NS_OK;
 }
 
+nsresult nsUrlClassifierUtils::CanonicalizeQuery(const nsACString& query,
+                                                 nsACString& _retval) {
+  _retval.Truncate();
+  _retval.Append('?');
+
+  // Unescape the query
+  nsAutoCString unescaped;
+  if (!NS_UnescapeURL(PromiseFlatCString(query).get(),
+                      PromiseFlatCString(query).Length(), 0, unescaped)) {
+    unescaped.Assign(query);
+  }
+
+  // slash folding does not apply to the query parameters, but we need to
+  // percent-escape all characters that are <= ASCII 32, >= 127, "#", or "%"
+  SpecialEncode(unescaped, false, _retval);
+
+  return NS_OK;
+}
+
 void nsUrlClassifierUtils::CleanupHostname(const nsACString& hostname,
                                            nsACString& _retval) {
   _retval.Truncate();