| OLD | NEW |
| (Empty) |
| 1 /* | |
| 2 * Copyright (C) 2007 Apple Inc. All rights reserved. | |
| 3 * | |
| 4 * Redistribution and use in source and binary forms, with or without | |
| 5 * modification, are permitted provided that the following conditions | |
| 6 * are met: | |
| 7 * | |
| 8 * 1. Redistributions of source code must retain the above copyright | |
| 9 * notice, this list of conditions and the following disclaimer. | |
| 10 * 2. Redistributions in binary form must reproduce the above copyright | |
| 11 * notice, this list of conditions and the following disclaimer in the | |
| 12 * documentation and/or other materials provided with the distribution. | |
| 13 * 3. Neither the name of Apple Computer, Inc. ("Apple") nor the names of | |
| 14 * its contributors may be used to endorse or promote products derived | |
| 15 * from this software without specific prior written permission. | |
| 16 * | |
| 17 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY | |
| 18 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED | |
| 19 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE | |
| 20 * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY | |
| 21 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES | |
| 22 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; | |
| 23 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND | |
| 24 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | |
| 25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | |
| 26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | |
| 27 */ | |
| 28 | |
| 29 #include "platform/weborigin/DatabaseIdentifier.h" | |
| 30 | |
| 31 #include "platform/weborigin/KURL.h" | |
| 32 #include "platform/weborigin/KnownPorts.h" | |
| 33 #include "platform/weborigin/SchemeRegistry.h" | |
| 34 #include "platform/weborigin/SecurityOriginCache.h" | |
| 35 #include "platform/weborigin/SecurityPolicy.h" | |
| 36 #include "wtf/HexNumber.h" | |
| 37 #include "wtf/StdLibExtras.h" | |
| 38 #include "wtf/text/StringBuilder.h" | |
| 39 | |
| 40 namespace blink { | |
| 41 | |
| 42 namespace { | |
| 43 | |
| 44 String escapeIPv6Hostname(const String& hostname) | |
| 45 { | |
| 46 // Shortest IPv6 hostname would be "[::1]". | |
| 47 if (hostname.length() < 5 || hostname[0] != '[' || hostname[hostname.length(
) - 1] != ']') | |
| 48 return hostname; | |
| 49 | |
| 50 // Should be canonicalized before it gets this far. | |
| 51 // i.e. "[::ffff:8190:3426]" not "[::FFFF:129.144.52.38]" | |
| 52 ASSERT(!hostname.contains('.')); | |
| 53 ASSERT(hostname == hostname.lower()); | |
| 54 | |
| 55 String copy = hostname; | |
| 56 copy.replace(':', '_'); | |
| 57 return copy; | |
| 58 } | |
| 59 | |
| 60 String unescapeIPv6Hostname(const String& hostname) | |
| 61 { | |
| 62 if (hostname.length() < 5 || hostname[0] != '[' || hostname[hostname.length(
) - 1] != ']') | |
| 63 return hostname; | |
| 64 | |
| 65 String copy = hostname; | |
| 66 copy.replace('_', ':'); | |
| 67 return copy; | |
| 68 } | |
| 69 | |
| 70 } // namespace | |
| 71 | |
| 72 const int maxAllowedPort = 65535; | |
| 73 | |
| 74 static const char separatorCharacter = '_'; | |
| 75 | |
| 76 PassRefPtr<SecurityOrigin> createSecurityOriginFromDatabaseIdentifier(const Stri
ng& databaseIdentifier) | |
| 77 { | |
| 78 if (!databaseIdentifier.containsOnlyASCII()) | |
| 79 return SecurityOrigin::createUnique(); | |
| 80 | |
| 81 // Match restrictions in storage/common/database/database_identifier.cc | |
| 82 // TODO(jsbell): Eliminate duplicate implementations. | |
| 83 if (databaseIdentifier.contains("..")) | |
| 84 return SecurityOrigin::createUnique(); | |
| 85 char forbidden[] = {'\\', '/', ':', '\0'}; | |
| 86 for (auto c : forbidden) { | |
| 87 if (databaseIdentifier.contains(c)) | |
| 88 return SecurityOrigin::createUnique(); | |
| 89 } | |
| 90 | |
| 91 // Make sure there's a first separator | |
| 92 size_t separator1 = databaseIdentifier.find(separatorCharacter); | |
| 93 if (separator1 == kNotFound) | |
| 94 return SecurityOrigin::createUnique(); | |
| 95 | |
| 96 // Make sure there's a second separator | |
| 97 size_t separator2 = databaseIdentifier.reverseFind(separatorCharacter); | |
| 98 if (separator2 == kNotFound) | |
| 99 return SecurityOrigin::createUnique(); | |
| 100 | |
| 101 // Ensure there were at least 2 separator characters. Some hostnames on intr
anets have | |
| 102 // underscores in them, so we'll assume that any additional underscores are
part of the host. | |
| 103 if (separator1 == separator2) | |
| 104 return SecurityOrigin::createUnique(); | |
| 105 | |
| 106 // Make sure the port section is a valid port number or doesn't exist | |
| 107 bool portOkay; | |
| 108 int port = databaseIdentifier.right(databaseIdentifier.length() - separator2
- 1).toInt(&portOkay); | |
| 109 bool portAbsent = (separator2 == databaseIdentifier.length() - 1); | |
| 110 if (!(portOkay || portAbsent)) | |
| 111 return SecurityOrigin::createUnique(); | |
| 112 | |
| 113 if (port < 0 || port > maxAllowedPort) | |
| 114 return SecurityOrigin::createUnique(); | |
| 115 | |
| 116 // Split out the 3 sections of data | |
| 117 String protocol = databaseIdentifier.substring(0, separator1); | |
| 118 String host = unescapeIPv6Hostname(databaseIdentifier.substring(separator1 +
1, separator2 - separator1 - 1)); | |
| 119 | |
| 120 // Make sure the components match their canonical representation so we are s
ure we're round tripping correctly. | |
| 121 KURL url(KURL(), protocol + "://" + host + ":" + String::number(port) + "/")
; | |
| 122 if (!url.isValid() || url.protocol() != protocol || url.host() != host) | |
| 123 return SecurityOrigin::createUnique(); | |
| 124 | |
| 125 return SecurityOrigin::create(url); | |
| 126 } | |
| 127 | |
| 128 String createDatabaseIdentifierFromSecurityOrigin(const SecurityOrigin* security
Origin) | |
| 129 { | |
| 130 String separatorString(&separatorCharacter, 1); | |
| 131 return securityOrigin->protocol() + separatorString + escapeIPv6Hostname(sec
urityOrigin->host()) + separatorString + String::number(securityOrigin->port()); | |
| 132 } | |
| 133 | |
| 134 } // namespace blink | |
| OLD | NEW |