Generating CIDs in Blink during MHTML serialization.

third_party/WebKit/Source/platform/mhtml/MHTMLParser.cpp

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 382 matching lines @@
 size_t MHTMLParser::subResourceCount() const
 {
     return m_resources.size();
 }
 
 ArchiveResource* MHTMLParser::subResourceAt(size_t index) const
 {
     return m_resources[index].get();
 }
 
+// static
+KURL MHTMLParser::convertContentIDToURI(const String& contentID)
+{
+    // This function is based primarily on an example from rfc2557 in section
+    // 9.5, but also based on more normative parts of specs like:
+    // - rfc2557 - MHTML - section 8.3 - "Use of the Content-ID header and CID URLs"
+    // - rfc1738 - URL - section 4 (reserved scheme names;  includes "cid")
+    // - rfc2387 - multipart/related - section 3.4 - "Syntax" (cid := msg-id)
+    // - rfc0822 - msg-id = "<" addr-spec ">"; addr-spec = local-part "@" domain
+
+    if (contentID.length() <= 2)
+        return KURL();
+
+    if (!contentID.startsWith('<') || !contentID.endsWith('>'))
+        return KURL();
+
+    StringBuilder uriBuilder;
+    uriBuilder.append("cid:");
+    uriBuilder.append(contentID, 1, contentID.length() - 2);
+    return KURL(KURL(), uriBuilder.toString());

[dcheng, 2015/12/01 04:19:31]

Maybe use ParsedURLString? It's guaranteed that uriBuilder.toString() will be a
valid URL right?

[Łukasz Anforowicz, 2015/12/01 18:45:14]

I almost made the change you've suggested, but started having second thoughts
after realizing that I can't really add an assert that the url will be always
valid.  This is because |contentID| may come from an untrusted source (i.e. from
MHTML/MIME headers from an MHTML document).  Additionally, this doesn't feel
like a performance-sensitive code path (OTOH, this statement is based on an
armchair analysis rather than on data), so it might be better to just play it
safe.

Given above, I think it is better to leave it as is.  WDYT?

+}
+
 } // namespace blink