Closes #7142: Sanitize url in HttpIconLoader

components/browser/icons/src/main/java/mozilla/components/browser/icons/extension/IconMessage.kt

@@ -88,7 +88,7 @@ private fun JSONObject.toIconResource(): IconRequest.Resource? {
         val maskable = optBoolean("maskable", false)
 
         return IconRequest.Resource(
-            url = url,
+            url = url.trim(),
             type = type,
             sizes = sizes,
             mimeType = if (mimeType.isNullOrEmpty()) null else mimeType,

components/browser/icons/src/test/java/mozilla/components/browser/icons/extension/IconMessageKtTest.kt

@@ -42,4 +42,21 @@ class IconMessageKtTest {
         val restoredResources = json.toIconResources()
         assertEquals(resources, restoredResources)
     }
+
+    @Test
+    fun `Url must be sanitized`() {
+        val resources = listOf(
+            IconRequest.Resource(
+                url = "\nhttps://www.mozilla.org/icon64.png\n",
+                sizes = listOf(Size(64, 64)),
+                mimeType = "image/png",
+                type = IconRequest.Resource.Type.FAVICON
+            )
+        )
+
+        val json = resources.toJSON()
+
+        val restoredResource = json.toIconResources().first()
+        assertEquals("https://www.mozilla.org/icon64.png", restoredResource.url)
+    }
 }

docs/changelog.md

@@ -12,6 +12,9 @@ permalink: /changelog/
 * [Gecko](https://github.com/mozilla-mobile/android-components/blob/master/buildSrc/src/main/java/Gecko.kt)
 * [Configuration](https://github.com/mozilla-mobile/android-components/blob/master/buildSrc/src/main/java/Config.kt)
 
+* **browser-icons**
+  * Fixed issue [#7142](https://github.com/mozilla-mobile/android-components/issues/7142)
+
 # 44.0.0
 
 * [Commits](https://github.com/mozilla-mobile/android-components/compare/v43.0.0...v44.0.0)