| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright (C) 2000 Peter Kelly (pmk@post.com) | 2 * Copyright (C) 2000 Peter Kelly (pmk@post.com) |
| 3 * Copyright (C) 2005, 2006, 2008, 2014 Apple Inc. All rights reserved. | 3 * Copyright (C) 2005, 2006, 2008, 2014 Apple Inc. All rights reserved. |
| 4 * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org) | 4 * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org) |
| 5 * Copyright (C) 2007 Samuel Weinig (sam@webkit.org) | 5 * Copyright (C) 2007 Samuel Weinig (sam@webkit.org) |
| 6 * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies) | 6 * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies) |
| 7 * Copyright (C) 2008 Holger Hans Peter Freyther | 7 * Copyright (C) 2008 Holger Hans Peter Freyther |
| 8 * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. | 8 * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. |
| 9 * (http://www.torchmobile.com/) | 9 * (http://www.torchmobile.com/) |
| 10 * | 10 * |
| (...skipping 560 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 571 #define xmlParseChunk \ | 571 #define xmlParseChunk \ |
| 572 #error "Use parseChunk instead to select the correct encoding." | 572 #error "Use parseChunk instead to select the correct encoding." |
| 573 | 573 |
| 574 static bool isLibxmlDefaultCatalogFile(const String& urlString) { | 574 static bool isLibxmlDefaultCatalogFile(const String& urlString) { |
| 575 // On non-Windows platforms libxml asks for this URL, the | 575 // On non-Windows platforms libxml asks for this URL, the |
| 576 // "XML_XML_DEFAULT_CATALOG", on initialization. | 576 // "XML_XML_DEFAULT_CATALOG", on initialization. |
| 577 if (urlString == "file:///etc/xml/catalog") | 577 if (urlString == "file:///etc/xml/catalog") |
| 578 return true; | 578 return true; |
| 579 | 579 |
| 580 // On Windows, libxml computes a URL relative to where its DLL resides. | 580 // On Windows, libxml computes a URL relative to where its DLL resides. |
| 581 if (urlString.startsWith("file:///", TextCaseInsensitive) && | 581 if (urlString.startsWith("file:///", TextCaseASCIIInsensitive) && |
| 582 urlString.endsWith("/etc/catalog", TextCaseInsensitive)) | 582 urlString.endsWith("/etc/catalog", TextCaseASCIIInsensitive)) |
| 583 return true; | 583 return true; |
| 584 return false; | 584 return false; |
| 585 } | 585 } |
| 586 | 586 |
| 587 static bool shouldAllowExternalLoad(const KURL& url) { | 587 static bool shouldAllowExternalLoad(const KURL& url) { |
| 588 String urlString = url.getString(); | 588 String urlString = url.getString(); |
| 589 | 589 |
| 590 // This isn't really necessary now that initializeLibXMLIfNecessary | 590 // This isn't really necessary now that initializeLibXMLIfNecessary |
| 591 // disables catalog support in libxml, but keeping it for defense in depth. | 591 // disables catalog support in libxml, but keeping it for defense in depth. |
| 592 if (isLibxmlDefaultCatalogFile(url)) | 592 if (isLibxmlDefaultCatalogFile(url)) |
| 593 return false; | 593 return false; |
| 594 | 594 |
| 595 // The most common DTD. There isn't much point in hammering www.w3c.org by | 595 // The most common DTD. There isn't much point in hammering www.w3c.org by |
| 596 // requesting this URL for every XHTML document. | 596 // requesting this URL for every XHTML document. |
| 597 if (urlString.startsWith("http://www.w3.org/TR/xhtml", TextCaseInsensitive)) | 597 if (urlString.startsWith("http://www.w3.org/TR/xhtml", |
| 598 TextCaseASCIIInsensitive)) |
| 598 return false; | 599 return false; |
| 599 | 600 |
| 600 // Similarly, there isn't much point in requesting the SVG DTD. | 601 // Similarly, there isn't much point in requesting the SVG DTD. |
| 601 if (urlString.startsWith("http://www.w3.org/Graphics/SVG", | 602 if (urlString.startsWith("http://www.w3.org/Graphics/SVG", |
| 602 TextCaseInsensitive)) | 603 TextCaseASCIIInsensitive)) |
| 603 return false; | 604 return false; |
| 604 | 605 |
| 605 // The libxml doesn't give us a lot of context for deciding whether to allow | 606 // The libxml doesn't give us a lot of context for deciding whether to allow |
| 606 // this request. In the worst case, this load could be for an external | 607 // this request. In the worst case, this load could be for an external |
| 607 // entity and the resulting document could simply read the retrieved | 608 // entity and the resulting document could simply read the retrieved |
| 608 // content. If we had more context, we could potentially allow the parser to | 609 // content. If we had more context, we could potentially allow the parser to |
| 609 // load a DTD. As things stand, we take the conservative route and allow | 610 // load a DTD. As things stand, we take the conservative route and allow |
| 610 // same-origin requests only. | 611 // same-origin requests only. |
| 611 if (!XMLDocumentParserScope::currentDocument->getSecurityOrigin()->canRequest( | 612 if (!XMLDocumentParserScope::currentDocument->getSecurityOrigin()->canRequest( |
| 612 url)) { | 613 url)) { |
| (...skipping 1093 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1706 RefPtr<XMLParserContext> parser = | 1707 RefPtr<XMLParserContext> parser = |
| 1707 XMLParserContext::createStringParser(&sax, &state); | 1708 XMLParserContext::createStringParser(&sax, &state); |
| 1708 String parseString = "<?xml version=\"1.0\"?><attrs " + string + " />"; | 1709 String parseString = "<?xml version=\"1.0\"?><attrs " + string + " />"; |
| 1709 parseChunk(parser->context(), parseString); | 1710 parseChunk(parser->context(), parseString); |
| 1710 finishParsing(parser->context()); | 1711 finishParsing(parser->context()); |
| 1711 attrsOK = state.gotAttributes; | 1712 attrsOK = state.gotAttributes; |
| 1712 return state.attributes; | 1713 return state.attributes; |
| 1713 } | 1714 } |
| 1714 | 1715 |
| 1715 } // namespace blink | 1716 } // namespace blink |
| OLD | NEW |