OLD | NEW |
1 /* | 1 /* |
2 * Copyright (C) 2000 Peter Kelly (pmk@post.com) | 2 * Copyright (C) 2000 Peter Kelly (pmk@post.com) |
3 * Copyright (C) 2005, 2006, 2008, 2014 Apple Inc. All rights reserved. | 3 * Copyright (C) 2005, 2006, 2008, 2014 Apple Inc. All rights reserved. |
4 * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org) | 4 * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org) |
5 * Copyright (C) 2007 Samuel Weinig (sam@webkit.org) | 5 * Copyright (C) 2007 Samuel Weinig (sam@webkit.org) |
6 * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies) | 6 * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies) |
7 * Copyright (C) 2008 Holger Hans Peter Freyther | 7 * Copyright (C) 2008 Holger Hans Peter Freyther |
8 * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmo
bile.com/) | 8 * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmo
bile.com/) |
9 * | 9 * |
10 * This library is free software; you can redistribute it and/or | 10 * This library is free software; you can redistribute it and/or |
(...skipping 628 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
639 // Similarly, there isn't much point in requesting the SVG DTD. | 639 // Similarly, there isn't much point in requesting the SVG DTD. |
640 if (urlString.startsWith("http://www.w3.org/Graphics/SVG", TextCaseInsensiti
ve)) | 640 if (urlString.startsWith("http://www.w3.org/Graphics/SVG", TextCaseInsensiti
ve)) |
641 return false; | 641 return false; |
642 | 642 |
643 // The libxml doesn't give us a lot of context for deciding whether to allow | 643 // The libxml doesn't give us a lot of context for deciding whether to allow |
644 // this request. In the worst case, this load could be for an external | 644 // this request. In the worst case, this load could be for an external |
645 // entity and the resulting document could simply read the retrieved | 645 // entity and the resulting document could simply read the retrieved |
646 // content. If we had more context, we could potentially allow the parser to | 646 // content. If we had more context, we could potentially allow the parser to |
647 // load a DTD. As things stand, we take the conservative route and allow | 647 // load a DTD. As things stand, we take the conservative route and allow |
648 // same-origin requests only. | 648 // same-origin requests only. |
649 if (!XMLDocumentParserScope::currentDocument->securityOrigin()->canRequest(u
rl)) { | 649 if (!XMLDocumentParserScope::currentDocument->getSecurityOrigin()->canReques
t(url)) { |
650 // FIXME: This is copy/pasted. We should probably build console logging
into canRequest(). | 650 // FIXME: This is copy/pasted. We should probably build console logging
into canRequest(). |
651 if (!url.isNull()) { | 651 if (!url.isNull()) { |
652 String message = "Unsafe attempt to load URL " + url.elidedString()
+ | 652 String message = "Unsafe attempt to load URL " + url.elidedString()
+ |
653 " from frame with URL " + XMLDocumentParserScope::currentDocumen
t->url().elidedString() + | 653 " from frame with URL " + XMLDocumentParserScope::currentDocumen
t->url().elidedString() + |
654 ". Domains, protocols and ports must match.\n"; | 654 ". Domains, protocols and ports must match.\n"; |
655 XMLDocumentParserScope::currentDocument->addConsoleMessage(ConsoleMe
ssage::create(SecurityMessageSource, ErrorMessageLevel, message)); | 655 XMLDocumentParserScope::currentDocument->addConsoleMessage(ConsoleMe
ssage::create(SecurityMessageSource, ErrorMessageLevel, message)); |
656 } | 656 } |
657 return false; | 657 return false; |
658 } | 658 } |
659 | 659 |
(...skipping 1035 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1695 sax.initialized = XML_SAX2_MAGIC; | 1695 sax.initialized = XML_SAX2_MAGIC; |
1696 RefPtr<XMLParserContext> parser = XMLParserContext::createStringParser(&sax,
&state); | 1696 RefPtr<XMLParserContext> parser = XMLParserContext::createStringParser(&sax,
&state); |
1697 String parseString = "<?xml version=\"1.0\"?><attrs " + string + " />"; | 1697 String parseString = "<?xml version=\"1.0\"?><attrs " + string + " />"; |
1698 parseChunk(parser->context(), parseString); | 1698 parseChunk(parser->context(), parseString); |
1699 finishParsing(parser->context()); | 1699 finishParsing(parser->context()); |
1700 attrsOK = state.gotAttributes; | 1700 attrsOK = state.gotAttributes; |
1701 return state.attributes; | 1701 return state.attributes; |
1702 } | 1702 } |
1703 | 1703 |
1704 } // namespace blink | 1704 } // namespace blink |
OLD | NEW |