| Index: third_party/WebKit/Source/modules/webdatabase/DatabaseAuthorizer.cpp
|
| diff --git a/third_party/WebKit/Source/modules/webdatabase/DatabaseAuthorizer.cpp b/third_party/WebKit/Source/modules/webdatabase/DatabaseAuthorizer.cpp
|
| index 345d5c63df28db77897ed41ee4272cb39ff8bcc5..353d3b02dff8d0a2071a212eb86a381ba59b7cb3 100644
|
| --- a/third_party/WebKit/Source/modules/webdatabase/DatabaseAuthorizer.cpp
|
| +++ b/third_party/WebKit/Source/modules/webdatabase/DatabaseAuthorizer.cpp
|
| @@ -28,6 +28,10 @@
|
|
|
| #include "modules/webdatabase/DatabaseAuthorizer.h"
|
|
|
| +#include "wtf/HashSet.h"
|
| +#include "wtf/StdLibExtras.h"
|
| +#include "wtf/text/StringHash.h"
|
| +
|
| namespace blink {
|
|
|
| DatabaseAuthorizer* DatabaseAuthorizer::create(const String& databaseInfoTableName)
|
| @@ -42,7 +46,6 @@ DatabaseAuthorizer::DatabaseAuthorizer(const String& databaseInfoTableName)
|
| DCHECK(isMainThread());
|
|
|
| reset();
|
| - addWhitelistedFunctions();
|
| }
|
|
|
| void DatabaseAuthorizer::reset()
|
| @@ -57,68 +60,70 @@ void DatabaseAuthorizer::resetDeletes()
|
| m_hadDeletes = false;
|
| }
|
|
|
| -void DatabaseAuthorizer::addWhitelistedFunctions()
|
| -{
|
| - // SQLite functions used to help implement some operations
|
| - // ALTER TABLE helpers
|
| - m_whitelistedFunctions.add("sqlite_rename_table");
|
| - m_whitelistedFunctions.add("sqlite_rename_trigger");
|
| - // GLOB helpers
|
| - m_whitelistedFunctions.add("glob");
|
| -
|
| - // SQLite core functions
|
| - m_whitelistedFunctions.add("abs");
|
| - m_whitelistedFunctions.add("changes");
|
| - m_whitelistedFunctions.add("coalesce");
|
| - m_whitelistedFunctions.add("glob");
|
| - m_whitelistedFunctions.add("ifnull");
|
| - m_whitelistedFunctions.add("hex");
|
| - m_whitelistedFunctions.add("last_insert_rowid");
|
| - m_whitelistedFunctions.add("length");
|
| - m_whitelistedFunctions.add("like");
|
| - m_whitelistedFunctions.add("lower");
|
| - m_whitelistedFunctions.add("ltrim");
|
| - m_whitelistedFunctions.add("max");
|
| - m_whitelistedFunctions.add("min");
|
| - m_whitelistedFunctions.add("nullif");
|
| - m_whitelistedFunctions.add("quote");
|
| - m_whitelistedFunctions.add("replace");
|
| - m_whitelistedFunctions.add("round");
|
| - m_whitelistedFunctions.add("rtrim");
|
| - m_whitelistedFunctions.add("soundex");
|
| - m_whitelistedFunctions.add("sqlite_source_id");
|
| - m_whitelistedFunctions.add("sqlite_version");
|
| - m_whitelistedFunctions.add("substr");
|
| - m_whitelistedFunctions.add("total_changes");
|
| - m_whitelistedFunctions.add("trim");
|
| - m_whitelistedFunctions.add("typeof");
|
| - m_whitelistedFunctions.add("upper");
|
| - m_whitelistedFunctions.add("zeroblob");
|
| -
|
| - // SQLite date and time functions
|
| - m_whitelistedFunctions.add("date");
|
| - m_whitelistedFunctions.add("time");
|
| - m_whitelistedFunctions.add("datetime");
|
| - m_whitelistedFunctions.add("julianday");
|
| - m_whitelistedFunctions.add("strftime");
|
| -
|
| - // SQLite aggregate functions
|
| - // max() and min() are already in the list
|
| - m_whitelistedFunctions.add("avg");
|
| - m_whitelistedFunctions.add("count");
|
| - m_whitelistedFunctions.add("group_concat");
|
| - m_whitelistedFunctions.add("sum");
|
| - m_whitelistedFunctions.add("total");
|
| -
|
| - // SQLite FTS functions
|
| - m_whitelistedFunctions.add("match");
|
| - m_whitelistedFunctions.add("snippet");
|
| - m_whitelistedFunctions.add("offsets");
|
| - m_whitelistedFunctions.add("optimize");
|
| -
|
| - // SQLite ICU functions
|
| - // like(), lower() and upper() are already in the list
|
| - m_whitelistedFunctions.add("regexp");
|
| +namespace {
|
| +using FunctionNameList = HashSet<String, CaseFoldingHash>;
|
| +
|
| +const FunctionNameList& whitelistedFunctions()
|
| +{
|
| + DEFINE_STATIC_LOCAL(FunctionNameList, list, ({
|
| + // SQLite functions used to help implement some operations
|
| + // ALTER TABLE helpers
|
| + "sqlite_rename_table",
|
| + "sqlite_rename_trigger",
|
| + // GLOB helpers
|
| + "glob",
|
| + // SQLite core functions
|
| + "abs",
|
| + "changes",
|
| + "coalesce",
|
| + "glob",
|
| + "ifnull",
|
| + "hex",
|
| + "last_insert_rowid",
|
| + "length",
|
| + "like",
|
| + "lower",
|
| + "ltrim",
|
| + "max",
|
| + "min",
|
| + "nullif",
|
| + "quote",
|
| + "replace",
|
| + "round",
|
| + "rtrim",
|
| + "soundex",
|
| + "sqlite_source_id",
|
| + "sqlite_version",
|
| + "substr",
|
| + "total_changes",
|
| + "trim",
|
| + "typeof",
|
| + "upper",
|
| + "zeroblob",
|
| + // SQLite date and time functions
|
| + "date",
|
| + "time",
|
| + "datetime",
|
| + "julianday",
|
| + "strftime",
|
| + // SQLite aggregate functions
|
| + // max() and min() are already in the list
|
| + "avg",
|
| + "count",
|
| + "group_concat",
|
| + "sum",
|
| + "total",
|
| + // SQLite FTS functions
|
| + "match",
|
| + "snippet",
|
| + "offsets",
|
| + "optimize",
|
| + // SQLite ICU functions
|
| + // like(), lower() and upper() are already in the list
|
| + "regexp",
|
| + }));
|
| + return list;
|
| +}
|
| }
|
|
|
| int DatabaseAuthorizer::createTable(const String& tableName)
|
| @@ -373,7 +378,7 @@ int DatabaseAuthorizer::allowDetach(const String&)
|
|
|
| int DatabaseAuthorizer::allowFunction(const String& functionName)
|
| {
|
| - if (m_securityEnabled && !m_whitelistedFunctions.contains(functionName))
|
| + if (m_securityEnabled && !whitelistedFunctions().contains(functionName))
|
| return SQLAuthDeny;
|
|
|
| return SQLAuthAllow;
|
|
|