URL check in bat_get_media.cc is not strict enough

[diracdeltas]

https://github.com/brave/brave-core/blob/194e5db6b091490576ce8bd191004cd12dc5c7d6/vendor/bat-native-ledger/src/bat_get_media.cc#L46

i assume url.find(".ttvnw.net/v1/segment/") is trying to match subdomains of ttvnw.net, but it would actually match arbitrary domains like this: https://example.com/something.ttvnw.net/v1/segment/ because . is valid in URL paths.

cc @SergeyZhukovsky @jasonrsadler

[jasonrsadler]

We're going to need some kind of url parser for this.

@bridiver Can we use GURL for this?

https://github.com/brave/brave-core/blob/194e5db6b091490576ce8bd191004cd12dc5c7d6/vendor/bat-native-ledger/src/bat_get_media.cc#L47

url.find("https://ttvnw.net/v1/segment/") != std::string::npos would match: https://baddomain.com?maliciousparam=https://ttvnw.net/v1/segment/

[jasonrsadler]

Adding QA-Yes for regression testing

[btlechowski]

Verification passed on

Brave	0.63.14 Chromium: 73.0.3683.75 (Official Build) dev (64-bit)
Revision	909ee014fcea6828f9a610e6716145bc0b3ebf4a-refs/branch-heads/3683@{#803}
OS	Windows 10 OS Build 17134.523

Verified test plan from brave/brave-core#1792
Encountered #3590

Verification passed on

Brave	0.63.15 Chromium: 73.0.3683.75 (Official Build) dev (64-bit)
Revision	909ee014fcea6828f9a610e6716145bc0b3ebf4a-refs/branch-heads/3683@{#803}
OS	Linux

• Verified test plan from URL checks in bat-get-media are now validated brave-core#1792
• Encountered panel not showing twitch publisher info for VOD #3590

Verified passed with

Brave	0.63.31 Chromium: 73.0.3683.75 (Official Build) beta(64-bit)
Revision	909ee014fcea6828f9a610e6716145bc0b3ebf4a-refs/branch-heads/3683@{#803}
OS	Mac OS X

• Verified test plan from URL checks in bat-get-media are now validated brave-core#1792. Checked panel and auto contribute list for both verified and unverified sites, YouTube and Twitch channels.
• Encountered panel not showing twitch publisher info for VOD #3590