| OLD | NEW |
| (Empty) |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include "sky/engine/core/fetch/FetchUtils.h" | |
| 6 | |
| 7 #include "sky/engine/platform/network/HTTPHeaderMap.h" | |
| 8 #include "sky/engine/platform/network/HTTPParsers.h" | |
| 9 #include "sky/engine/wtf/HashSet.h" | |
| 10 #include "sky/engine/wtf/Threading.h" | |
| 11 #include "sky/engine/wtf/text/AtomicString.h" | |
| 12 #include "sky/engine/wtf/text/WTFString.h" | |
| 13 | |
| 14 namespace blink { | |
| 15 | |
| 16 namespace { | |
| 17 | |
| 18 class ForbiddenHeaderNames { | |
| 19 WTF_MAKE_NONCOPYABLE(ForbiddenHeaderNames); WTF_MAKE_FAST_ALLOCATED; | |
| 20 public: | |
| 21 bool has(const String& name) const | |
| 22 { | |
| 23 return m_fixedNames.contains(name) | |
| 24 || name.startsWith(m_proxyHeaderPrefix, false) | |
| 25 || name.startsWith(m_secHeaderPrefix, false); | |
| 26 } | |
| 27 | |
| 28 static const ForbiddenHeaderNames* get(); | |
| 29 | |
| 30 private: | |
| 31 ForbiddenHeaderNames(); | |
| 32 | |
| 33 String m_proxyHeaderPrefix; | |
| 34 String m_secHeaderPrefix; | |
| 35 HashSet<String, CaseFoldingHash> m_fixedNames; | |
| 36 }; | |
| 37 | |
| 38 ForbiddenHeaderNames::ForbiddenHeaderNames() | |
| 39 : m_proxyHeaderPrefix("proxy-") | |
| 40 , m_secHeaderPrefix("sec-") | |
| 41 { | |
| 42 m_fixedNames.add("accept-charset"); | |
| 43 m_fixedNames.add("accept-encoding"); | |
| 44 m_fixedNames.add("access-control-request-headers"); | |
| 45 m_fixedNames.add("access-control-request-method"); | |
| 46 m_fixedNames.add("connection"); | |
| 47 m_fixedNames.add("content-length"); | |
| 48 m_fixedNames.add("cookie"); | |
| 49 m_fixedNames.add("cookie2"); | |
| 50 m_fixedNames.add("date"); | |
| 51 m_fixedNames.add("dnt"); | |
| 52 m_fixedNames.add("expect"); | |
| 53 m_fixedNames.add("host"); | |
| 54 m_fixedNames.add("keep-alive"); | |
| 55 m_fixedNames.add("origin"); | |
| 56 m_fixedNames.add("referer"); | |
| 57 m_fixedNames.add("te"); | |
| 58 m_fixedNames.add("trailer"); | |
| 59 m_fixedNames.add("transfer-encoding"); | |
| 60 m_fixedNames.add("upgrade"); | |
| 61 m_fixedNames.add("user-agent"); | |
| 62 m_fixedNames.add("via"); | |
| 63 } | |
| 64 | |
| 65 const ForbiddenHeaderNames* ForbiddenHeaderNames::get() | |
| 66 { | |
| 67 AtomicallyInitializedStatic(const ForbiddenHeaderNames*, instance = new Forb
iddenHeaderNames); | |
| 68 return instance; | |
| 69 } | |
| 70 | |
| 71 } // namespace | |
| 72 | |
| 73 bool FetchUtils::isSimpleMethod(const String& method) | |
| 74 { | |
| 75 // http://fetch.spec.whatwg.org/#simple-method | |
| 76 // "A simple method is a method that is `GET`, `HEAD`, or `POST`." | |
| 77 return method == "GET" || method == "HEAD" || method == "POST"; | |
| 78 } | |
| 79 | |
| 80 bool FetchUtils::isSimpleHeader(const AtomicString& name, const AtomicString& va
lue) | |
| 81 { | |
| 82 // http://fetch.spec.whatwg.org/#simple-header | |
| 83 // "A simple header is a header whose name is either one of `Accept`, | |
| 84 // `Accept-Language`, and `Content-Language`, or whose name is | |
| 85 // `Content-Type` and value, once parsed, is one of | |
| 86 // `application/x-www-form-urlencoded`, `multipart/form-data`, and | |
| 87 // `text/plain`." | |
| 88 | |
| 89 if (equalIgnoringCase(name, "accept") | |
| 90 || equalIgnoringCase(name, "accept-language") | |
| 91 || equalIgnoringCase(name, "content-language")) | |
| 92 return true; | |
| 93 | |
| 94 if (equalIgnoringCase(name, "content-type")) { | |
| 95 AtomicString mimeType = extractMIMETypeFromMediaType(value); | |
| 96 return equalIgnoringCase(mimeType, "application/x-www-form-urlencoded") | |
| 97 || equalIgnoringCase(mimeType, "multipart/form-data") | |
| 98 || equalIgnoringCase(mimeType, "text/plain"); | |
| 99 } | |
| 100 | |
| 101 return false; | |
| 102 } | |
| 103 | |
| 104 bool FetchUtils::isSimpleRequest(const String& method, const HTTPHeaderMap& head
erMap) | |
| 105 { | |
| 106 if (!isSimpleMethod(method)) | |
| 107 return false; | |
| 108 | |
| 109 HTTPHeaderMap::const_iterator end = headerMap.end(); | |
| 110 for (HTTPHeaderMap::const_iterator it = headerMap.begin(); it != end; ++it)
{ | |
| 111 // Preflight is required for MIME types that can not be sent via form | |
| 112 // submission. | |
| 113 if (!isSimpleHeader(it->key, it->value)) | |
| 114 return false; | |
| 115 } | |
| 116 | |
| 117 return true; | |
| 118 } | |
| 119 | |
| 120 bool FetchUtils::isForbiddenMethod(const String& method) | |
| 121 { | |
| 122 // http://fetch.spec.whatwg.org/#forbidden-method | |
| 123 // "A forbidden method is a method that is a byte case-insensitive match" | |
| 124 // for one of `CONNECT`, `TRACE`, and `TRACK`." | |
| 125 return equalIgnoringCase(method, "TRACE") | |
| 126 || equalIgnoringCase(method, "TRACK") | |
| 127 || equalIgnoringCase(method, "CONNECT"); | |
| 128 } | |
| 129 | |
| 130 bool FetchUtils::isForbiddenHeaderName(const String& name) | |
| 131 { | |
| 132 // http://fetch.spec.whatwg.org/#forbidden-header-name | |
| 133 // "A forbidden header name is a header names that is one of: | |
| 134 // `Accept-Charset`, `Accept-Encoding`, `Access-Control-Request-Headers`, | |
| 135 // `Access-Control-Request-Method`, `Connection`, | |
| 136 // `Content-Length, Cookie`, `Cookie2`, `Date`, `DNT`, `Expect`, `Host`, | |
| 137 // `Keep-Alive`, `Origin`, `Referer`, `TE`, `Trailer`, | |
| 138 // `Transfer-Encoding`, `Upgrade`, `User-Agent`, `Via` | |
| 139 // or starts with `Proxy-` or `Sec-` (including when it is just `Proxy-` or | |
| 140 // `Sec-`)." | |
| 141 | |
| 142 return ForbiddenHeaderNames::get()->has(name); | |
| 143 } | |
| 144 | |
| 145 bool FetchUtils::isForbiddenResponseHeaderName(const String& name) | |
| 146 { | |
| 147 // http://fetch.spec.whatwg.org/#forbidden-response-header-name | |
| 148 // "A forbidden response header name is a header name that is one of: | |
| 149 // `Set-Cookie`, `Set-Cookie2`" | |
| 150 | |
| 151 return equalIgnoringCase(name, "set-cookie") || equalIgnoringCase(name, "set
-cookie2"); | |
| 152 } | |
| 153 | |
| 154 bool FetchUtils::isSimpleOrForbiddenRequest(const String& method, const HTTPHead
erMap& headerMap) | |
| 155 { | |
| 156 if (!isSimpleMethod(method)) | |
| 157 return false; | |
| 158 | |
| 159 HTTPHeaderMap::const_iterator end = headerMap.end(); | |
| 160 for (HTTPHeaderMap::const_iterator it = headerMap.begin(); it != end; ++it)
{ | |
| 161 if (!isSimpleHeader(it->key, it->value) && !isForbiddenHeaderName(it->ke
y)) | |
| 162 return false; | |
| 163 } | |
| 164 | |
| 165 return true; | |
| 166 } | |
| 167 | |
| 168 } // namespace blink | |
| OLD | NEW |