| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright (C) 2000 Peter Kelly (pmk@post.com) | 2 * Copyright (C) 2000 Peter Kelly (pmk@post.com) |
| 3 * Copyright (C) 2005, 2006, 2008, 2014 Apple Inc. All rights reserved. | 3 * Copyright (C) 2005, 2006, 2008, 2014 Apple Inc. All rights reserved. |
| 4 * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org) | 4 * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org) |
| 5 * Copyright (C) 2007 Samuel Weinig (sam@webkit.org) | 5 * Copyright (C) 2007 Samuel Weinig (sam@webkit.org) |
| 6 * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies) | 6 * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies) |
| 7 * Copyright (C) 2008 Holger Hans Peter Freyther | 7 * Copyright (C) 2008 Holger Hans Peter Freyther |
| 8 * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmo
bile.com/) | 8 * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmo
bile.com/) |
| 9 * | 9 * |
| 10 * This library is free software; you can redistribute it and/or | 10 * This library is free software; you can redistribute it and/or |
| (...skipping 628 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 639 // Similarly, there isn't much point in requesting the SVG DTD. | 639 // Similarly, there isn't much point in requesting the SVG DTD. |
| 640 if (urlString.startsWith("http://www.w3.org/Graphics/SVG", TextCaseInsensiti
ve)) | 640 if (urlString.startsWith("http://www.w3.org/Graphics/SVG", TextCaseInsensiti
ve)) |
| 641 return false; | 641 return false; |
| 642 | 642 |
| 643 // The libxml doesn't give us a lot of context for deciding whether to allow | 643 // The libxml doesn't give us a lot of context for deciding whether to allow |
| 644 // this request. In the worst case, this load could be for an external | 644 // this request. In the worst case, this load could be for an external |
| 645 // entity and the resulting document could simply read the retrieved | 645 // entity and the resulting document could simply read the retrieved |
| 646 // content. If we had more context, we could potentially allow the parser to | 646 // content. If we had more context, we could potentially allow the parser to |
| 647 // load a DTD. As things stand, we take the conservative route and allow | 647 // load a DTD. As things stand, we take the conservative route and allow |
| 648 // same-origin requests only. | 648 // same-origin requests only. |
| 649 if (!XMLDocumentParserScope::currentDocument->securityOrigin()->canRequest(u
rl)) { | 649 if (!XMLDocumentParserScope::currentDocument->getSecurityOrigin()->canReques
t(url)) { |
| 650 // FIXME: This is copy/pasted. We should probably build console logging
into canRequest(). | 650 // FIXME: This is copy/pasted. We should probably build console logging
into canRequest(). |
| 651 if (!url.isNull()) { | 651 if (!url.isNull()) { |
| 652 String message = "Unsafe attempt to load URL " + url.elidedString()
+ | 652 String message = "Unsafe attempt to load URL " + url.elidedString()
+ |
| 653 " from frame with URL " + XMLDocumentParserScope::currentDocumen
t->url().elidedString() + | 653 " from frame with URL " + XMLDocumentParserScope::currentDocumen
t->url().elidedString() + |
| 654 ". Domains, protocols and ports must match.\n"; | 654 ". Domains, protocols and ports must match.\n"; |
| 655 XMLDocumentParserScope::currentDocument->addConsoleMessage(ConsoleMe
ssage::create(SecurityMessageSource, ErrorMessageLevel, message)); | 655 XMLDocumentParserScope::currentDocument->addConsoleMessage(ConsoleMe
ssage::create(SecurityMessageSource, ErrorMessageLevel, message)); |
| 656 } | 656 } |
| 657 return false; | 657 return false; |
| 658 } | 658 } |
| 659 | 659 |
| (...skipping 1035 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1695 sax.initialized = XML_SAX2_MAGIC; | 1695 sax.initialized = XML_SAX2_MAGIC; |
| 1696 RefPtr<XMLParserContext> parser = XMLParserContext::createStringParser(&sax,
&state); | 1696 RefPtr<XMLParserContext> parser = XMLParserContext::createStringParser(&sax,
&state); |
| 1697 String parseString = "<?xml version=\"1.0\"?><attrs " + string + " />"; | 1697 String parseString = "<?xml version=\"1.0\"?><attrs " + string + " />"; |
| 1698 parseChunk(parser->context(), parseString); | 1698 parseChunk(parser->context(), parseString); |
| 1699 finishParsing(parser->context()); | 1699 finishParsing(parser->context()); |
| 1700 attrsOK = state.gotAttributes; | 1700 attrsOK = state.gotAttributes; |
| 1701 return state.attributes; | 1701 return state.attributes; |
| 1702 } | 1702 } |
| 1703 | 1703 |
| 1704 } // namespace blink | 1704 } // namespace blink |
| OLD | NEW |