Fix Link header parsing bug with extension parameter parsing.

Source/core/loader/LinkHeader.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/loader/LinkHeader.h"
 
 #include "platform/ParsingUtilities.h"
 
 namespace blink {
 
 // LWSP definition in https://www.ietf.org/rfc/rfc0822.txt
 template <typename CharType>
 static bool isWhitespace(CharType chr)
 {
     return (chr == ' ') || (chr == '\t');
 }
 
 template <typename CharType>
 static bool isValidURLChar(CharType chr)
 {
     return !isWhitespace(chr) && chr != '>';
 }
 
 template <typename CharType>
 static bool isValidParameterNameChar(CharType chr)
 {
-    return !isWhitespace(chr) && chr != '=';
+    // TODO(yoav): We need to move this function to a central location and possibly rewrite as a lookup table. https://crbug.com/527324
+
+    // Alpha-numeric is a valid char.
+    // This is likely the common case - bailing early.
+    if (isASCIIAlphanumeric(chr))
+        return true;
+    // A separator or CTL or '%', '*' or '\'' means the char is not valid.
+    // So any of: |{}[]/\:;<=>?@,()*'"%

[Mike West, 2015/09/02 12:30:52]

TODO link to the bug you created?

[Yoav Weiss, 2015/09/02 12:32:33]

I did :D (a few lines up)

+    if (chr <= ' ' || chr > '|' || chr == '{' || chr == ']' || chr == '['
+        || chr == '/' || chr == '\\' || (chr <= '@' && chr >= ':') || chr == ','
+        || (chr >= '(' && chr <= '*') || chr == '\'' || chr == '"' || chr == '%') {
+        return false;
+    }
+    return true;
 }
 
 template <typename CharType>
 static bool isValidParameterValueEnd(CharType chr)
 {
     return chr == ';' || chr == ',';
 }
 
 template <typename CharType>
 static bool isValidParameterValueChar(CharType chr)
 {
     return !isWhitespace(chr) && !isValidParameterValueEnd(chr);
 }
 
+// Verify that the parameter is a link-extension which according to spec doesn't have to have a value.
 static bool isExtensionParameter(LinkHeader::LinkParameterName name)
 {
-    return name > LinkHeader::LinkParameterAnchor;
+    return name >= LinkHeader::LinkParameterUnknown;
 }
 
 // Before:
 //
 // <cat.jpg>; rel=preload
 // ^                     ^
 // position              end
 //
 // After (if successful: otherwise the method returns false)
 //
@@ skipping 53 matching lines @@
         return false;
     }
     skipWhile<CharType, isWhitespace>(position, end);
     if (validFieldEnd(position, end))
         return false;
     return true;
 }
 
 static LinkHeader::LinkParameterName paramterNameFromString(String name)
 {
-    // FIXME: Add support for more header parameters as neccessary.
     if (equalIgnoringCase(name, "rel"))
         return LinkHeader::LinkParameterRel;
     if (equalIgnoringCase(name, "anchor"))
         return LinkHeader::LinkParameterAnchor;
     if (equalIgnoringCase(name, "crossorigin"))
         return LinkHeader::LinkParameterCrossOrigin;
+    if (equalIgnoringCase(name, "title"))
+        return LinkHeader::LinkParameterTitle;
+    if (equalIgnoringCase(name, "media"))
+        return LinkHeader::LinkParameterMedia;
+    if (equalIgnoringCase(name, "type"))
+        return LinkHeader::LinkParameterType;
+    if (equalIgnoringCase(name, "rev"))
+        return LinkHeader::LinkParameterRev;
+    if (equalIgnoringCase(name, "hreflang"))
+        return LinkHeader::LinkParameterHreflang;
     return LinkHeader::LinkParameterUnknown;
 }
 
 // Before:
 //
 // <cat.jpg>; rel=preload
 //            ^          ^
 //            position   end
 //
 // After (if successful: otherwise the method returns false)
 //
 // <cat.jpg>; rel=preload
 //                ^      ^
 //            position  end
 template <typename CharType>
 static bool parseParameterName(CharType*& position, CharType* end, LinkHeader::LinkParameterName& name)
 {
     CharType* nameStart = position;
     skipWhile<CharType, isValidParameterNameChar>(position, end);
     CharType* nameEnd = position;
     skipWhile<CharType, isWhitespace>(position, end);
     bool hasEqual = skipExactly<CharType>(position, end, '=');
     skipWhile<CharType, isWhitespace>(position, end);
     name = paramterNameFromString(String(nameStart, nameEnd - nameStart));
-    return hasEqual || isExtensionParameter(name);
+    if (hasEqual)
+        return true;
+    bool validParameterValueEnd = (position == end) || isValidParameterValueEnd(*position);
+    return validParameterValueEnd && isExtensionParameter(name);
 }
 
 // Before:
 //
 // <cat.jpg>; rel="preload"; type="image/jpeg";
 //                ^                            ^
 //            position                        end
 //
 // After (if the parameter starts with a quote, otherwise the method returns false)
 //
@@ skipping 124 matching lines @@
 template <typename CharType>
 void LinkHeaderSet::init(CharType* headerValue, unsigned len)
 {
     CharType* position = headerValue;
     CharType* end = headerValue + len;
     while (position < end)
         m_headerSet.append(LinkHeader(position, end));
 }
 
 }