Implement headers attributes in ForeignFetchResponse

third_party/WebKit/Source/web/AssociatedURLLoader.cpp

 /*
  * Copyright (C) 2010, 2011, 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 54 matching lines @@
 
 private:
     bool m_isSafe;
 };
 
 void HTTPRequestHeaderValidator::visitHeader(const WebString& name, const WebString& value)
 {
     m_isSafe = m_isSafe && isValidHTTPToken(name) && !FetchUtils::isForbiddenHeaderName(name) && isValidHTTPHeaderValue(value);
 }
 
-// FIXME: Remove this and use WebCore code that does the same thing.
-class HTTPResponseHeaderValidator : public WebHTTPHeaderVisitor {
-    WTF_MAKE_NONCOPYABLE(HTTPResponseHeaderValidator);
-public:
-    HTTPResponseHeaderValidator(bool usingAccessControl) : m_usingAccessControl(usingAccessControl) { }
-
-    void visitHeader(const WebString& name, const WebString& value);
-    const HTTPHeaderSet& blockedHeaders();
-
-private:
-    HTTPHeaderSet m_exposedHeaders;
-    HTTPHeaderSet m_blockedHeaders;
-    bool m_usingAccessControl;
-};
-
-void HTTPResponseHeaderValidator::visitHeader(const WebString& name, const WebString& value)
-{
-    String headerName(name);
-    if (m_usingAccessControl) {
-        if (equalIgnoringCase(headerName, "access-control-expose-headers"))
-            parseAccessControlExposeHeadersAllowList(value, m_exposedHeaders);
-        else if (!isOnAccessControlResponseHeaderWhitelist(headerName))
-            m_blockedHeaders.add(static_cast<String>(name));
-    }
-}
-
-const HTTPHeaderSet& HTTPResponseHeaderValidator::blockedHeaders()
-{
-    // Remove exposed headers from the blocked set.
-    if (!m_exposedHeaders.isEmpty()) {
-        // Don't allow Set-Cookie headers to be exposed.
-        m_exposedHeaders.remove("set-cookie");
-        m_exposedHeaders.remove("set-cookie2");
-        // Block Access-Control-Expose-Header itself. It could be exposed later.
-        m_blockedHeaders.add("access-control-expose-headers");
-        m_blockedHeaders.removeAll(m_exposedHeaders);
-    }
-
-    return m_blockedHeaders;
-}
-
 } // namespace
 
 // This class bridges the interface differences between WebCore and WebKit loader clients.
 // It forwards its ThreadableLoaderClient notifications to a WebURLLoaderClient.
 class AssociatedURLLoader::ClientAdapter final : public DocumentThreadableLoaderClient {
     WTF_MAKE_NONCOPYABLE(ClientAdapter);
 public:
     static PassOwnPtr<ClientAdapter> create(AssociatedURLLoader*, WebURLLoaderClient*, const WebURLLoaderOptions&);
 
     // ThreadableLoaderClient
@@ skipping 72 matching lines @@
 
     m_client->didSendData(m_loader, bytesSent, totalBytesToBeSent);
 }
 
 void AssociatedURLLoader::ClientAdapter::didReceiveResponse(unsigned long, const ResourceResponse& response, PassOwnPtr<WebDataConsumerHandle> handle)
 {
     ASSERT_UNUSED(handle, !handle);
     if (!m_client)
         return;
 
-    // Try to use the original ResourceResponse if possible.
-    WebURLResponse validatedResponse = WrappedResourceResponse(response);
-    HTTPResponseHeaderValidator validator(m_options.crossOriginRequestPolicy == WebURLLoaderOptions::CrossOriginRequestPolicyUseAccessControl);
-    if (!m_options.exposeAllResponseHeaders)
-        validatedResponse.visitHTTPHeaderFields(&validator);
+    if (m_options.exposeAllResponseHeaders || m_options.crossOriginRequestPolicy != WebURLLoaderOptions::CrossOriginRequestPolicyUseAccessControl) {
+        // Use the original ResourceResponse.
+        m_client->didReceiveResponse(m_loader, WrappedResourceResponse(response));
+        return;
+    }
+
+    HTTPHeaderSet exposedHeaders;
+    extractCorsExposedHeaderNamesList(response, exposedHeaders);
+    HTTPHeaderSet blockedHeaders;
+    for (const auto& header : response.httpHeaderFields()) {
+        if (FetchUtils::isForbiddenResponseHeaderName(header.key) || (!isOnAccessControlResponseHeaderWhitelist(header.key) && !exposedHeaders.contains(header.key)))
+            blockedHeaders.add(header.key);
+    }
+
+    if (blockedHeaders.isEmpty()) {
+        // Use the original ResourceResponse.
+        m_client->didReceiveResponse(m_loader, WrappedResourceResponse(response));
+        return;
+    }
 
     // If there are blocked headers, copy the response so we can remove them.
-    const HTTPHeaderSet& blockedHeaders = validator.blockedHeaders();
-    if (!blockedHeaders.isEmpty()) {
-        validatedResponse = WebURLResponse(validatedResponse);
-        HTTPHeaderSet::const_iterator end = blockedHeaders.end();
-        for (HTTPHeaderSet::const_iterator it = blockedHeaders.begin(); it != end; ++it)
-            validatedResponse.clearHTTPHeaderField(*it);
-    }
+    WebURLResponse validatedResponse = WrappedResourceResponse(response);
+    for (const auto& header : blockedHeaders)
+        validatedResponse.clearHTTPHeaderField(header);
     m_client->didReceiveResponse(m_loader, validatedResponse);
 }
 
 void AssociatedURLLoader::ClientAdapter::didDownloadData(int dataLength)
 {
     if (!m_client)
         return;
 
     m_client->didDownloadData(m_loader, dataLength, -1);
 }
@@ skipping 248 matching lines @@
     // there could be a WebURLLoader instance behind the
     // DocumentThreadableLoader instance. So, for safety, we chose to just
     // crash here.
     RELEASE_ASSERT(ThreadState::current());
 
     m_observer->dispose();
     m_observer = nullptr;
 }
 
 } // namespace blink