[Import Maps] Disallow backtracking in prefix matching

Reflecting
WICG/import-maps#229

Bug: 848607, WICG/import-maps#207
Change-Id: Id056b3fd27489ecdfe45456220fd1d8c01dc8d3f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2570012
Commit-Queue: Hiroshige Hayashizaki <hiroshige@chromium.org>
Reviewed-by: Kouhei Ueno <kouhei@chromium.org>
Reviewed-by: Domenic Denicola <domenic@chromium.org>
Cr-Commit-Position: refs/heads/master@{#833945}
GitOrigin-RevId: 916cc2354cae22a6e8280f2a2b7ac66b30b99e67

blink/renderer/core/script/import_map.cc

@@ -492,7 +492,17 @@ KURL ImportMap::ResolveImportsMatchInternal(const String& key,
     return NullURL();
   }
 
-  // <spec step="1.2.8">Return url.</spec>
+  // <spec step="1.2.8">If the serialization of url does not start with the
+  // serialization of resolutionResult, then throw a TypeError indicating that
+  // resolution of normalizedSpecifier was blocked due to it backtracking above
+  // its prefix specifierKey.</spec>
+  if (!url.GetString().StartsWith(matched->value.GetString())) {
+    *debug_message = "Import Map: \"" + key + "\" matches with \"" +
+                     matched->key + "\" but is blocked due to backtracking";
+    return NullURL();
+  }
+
+  // <spec step="1.2.9">Return url.</spec>
   *debug_message = "Import Map: \"" + key + "\" matches with \"" +
                    matched->key + "\" and is mapped to " + url.ElidedString();
   return url;