Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(558)

Side by Side Diff: url/origin.h

Issue 2716583003: Rename Origin.unique() to opaque().
Patch Set: Mac fixes Created 3 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright 2015 The Chromium Authors. All rights reserved. 1 // Copyright 2015 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #ifndef URL_ORIGIN_H_ 5 #ifndef URL_ORIGIN_H_
6 #define URL_ORIGIN_H_ 6 #define URL_ORIGIN_H_
7 7
8 #include <stdint.h> 8 #include <stdint.h>
9 9
10 #include <string> 10 #include <string>
(...skipping 17 matching lines...) Expand all
28 // network connection, use 'url::SchemeHostPort'. 28 // network connection, use 'url::SchemeHostPort'.
29 // 29 //
30 // STL;SDR: If you aren't making actual network connections, use 'url::Origin'. 30 // STL;SDR: If you aren't making actual network connections, use 'url::Origin'.
31 // 31 //
32 // 'Origin', like 'SchemeHostPort', is composed of a tuple of (scheme, host, 32 // 'Origin', like 'SchemeHostPort', is composed of a tuple of (scheme, host,
33 // port), but contains a number of additional concepts which make it appropriate 33 // port), but contains a number of additional concepts which make it appropriate
34 // for use as a security boundary and access control mechanism between contexts. 34 // for use as a security boundary and access control mechanism between contexts.
35 // 35 //
36 // This class ought to be used when code needs to determine if two resources 36 // This class ought to be used when code needs to determine if two resources
37 // are "same-origin", and when a canonical serialization of an origin is 37 // are "same-origin", and when a canonical serialization of an origin is
38 // required. Note that some origins are "unique", meaning that they are not 38 // required. Note that some origins are "opaque", meaning that they are not
39 // same-origin with any other origin (including themselves). 39 // same-origin with any other origin (except themselves). This applies even if
40 // their serialization is identical: Two opaque origins created from parsing the
41 // same string will each be unique, and will not compare equal.
40 // 42 //
41 // There are a few subtleties to note: 43 // There are a few subtleties to note:
42 // 44 //
43 // * Invalid and non-standard GURLs are parsed as unique origins. This includes 45 // * Invalid and non-standard GURLs are parsed as opaque origins. This includes
44 // non-hierarchical URLs like 'data:text/html,...' and 'javascript:alert(1)'. 46 // non-hierarchical URLs like 'data:text/html,...' and 'javascript:alert(1)'.
45 // 47 //
46 // * GURLs with schemes of 'filesystem' or 'blob' parse the origin out of the 48 // * GURLs with schemes of 'filesystem' or 'blob' parse the origin out of the
47 // internals of the URL. That is, 'filesystem:https://example.com/temporary/f' 49 // internals of the URL. That is, 'filesystem:https://example.com/temporary/f'
48 // is parsed as ('https', 'example.com', 443). 50 // is parsed as ('https', 'example.com', 443).
49 // 51 //
50 // * Unique origins all serialize to the string "null"; this means that the 52 // * Unique origins all serialize to the string "null"; this means that the
51 // serializations of two unique origins are identical to each other, though 53 // serializations of two opaque origins are identical to each other, though
52 // the origins themselves are not "the same". This means that origins' 54 // the origins themselves are not "the same". This means that origins'
53 // serializations must not be relied upon for security checks. 55 // serializations must not be relied upon for security checks.
54 // 56 //
55 // * GURLs with a 'file' scheme are tricky. They are parsed as ('file', '', 0), 57 // * GURLs with a 'file' scheme are tricky. They are parsed as ('file', '', 0),
56 // but their behavior may differ from embedder to embedder. 58 // but their behavior may differ from embedder to embedder.
57 // 59 //
58 // * The host component of an IPv6 address includes brackets, just like the URL 60 // * The host component of an IPv6 address includes brackets, just like the URL
59 // representation. 61 // representation.
60 // 62 //
61 // Usage: 63 // Usage:
62 // 64 //
63 // * Origins are generally constructed from an already-canonicalized GURL: 65 // * Origins are generally constructed from an already-canonicalized GURL:
64 // 66 //
65 // GURL url("https://example.com/"); 67 // GURL url("https://example.com/");
66 // url::Origin origin(url); 68 // url::Origin origin(url);
67 // origin.scheme(); // "https" 69 // origin.scheme(); // "https"
68 // origin.host(); // "example.com" 70 // origin.host(); // "example.com"
69 // origin.port(); // 443 71 // origin.port(); // 443
70 // origin.unique(); // false 72 // origin.opaque(); // false
71 // 73 //
72 // * To answer the question "Are |this| and |that| "same-origin" with each 74 // * To answer the question "Are |this| and |that| "same-origin" with each
73 // other?", use |Origin::IsSameOriginWith|: 75 // other?", use |Origin::IsSameOriginWith|:
74 // 76 //
75 // if (this.IsSameOriginWith(that)) { 77 // if (this.IsSameOriginWith(that)) {
76 // // Amazingness goes here. 78 // // Amazingness goes here.
77 // } 79 // }
78 class URL_EXPORT Origin { 80 class URL_EXPORT Origin {
79 public: 81 public:
80 // Creates a unique Origin. 82 // Creates a unique opaque Origin.
81 Origin(); 83 Origin();
82 84
83 // Creates an Origin from |url|, as described at 85 // Creates an Origin from |url|, as described at
84 // https://url.spec.whatwg.org/#origin, with the following additions: 86 // https://url.spec.whatwg.org/#origin, with the following additions:
85 // 87 //
86 // 1. If |url| is invalid or non-standard, a unique Origin is constructed. 88 // 1. If |url| is invalid or non-standard, a unique opaque Origin is
89 // constructed.
87 // 2. 'filesystem' URLs behave as 'blob' URLs (that is, the origin is parsed 90 // 2. 'filesystem' URLs behave as 'blob' URLs (that is, the origin is parsed
88 // out of everything in the URL which follows the scheme). 91 // out of everything in the URL which follows the scheme).
89 // 3. 'file' URLs all parse as ("file", "", 0). 92 // 3. 'file' URLs all parse as ("file", "", 0).
90 explicit Origin(const GURL& url); 93 explicit Origin(const GURL& url);
91 94
92 // Creates an Origin from a |scheme|, |host|, and |port|. All the parameters 95 // Creates an Origin from a |scheme|, |host|, and |port|. All the parameters
93 // must be valid and canonicalized. Do not use this method to create unique 96 // must be valid and canonicalized. Do not use this method to create unique
94 // origins. Use Origin() for that. 97 // origins. Use Origin() for that.
95 // 98 //
96 // This constructor should be used in order to pass 'Origin' objects back and 99 // This constructor should be used in order to pass 'Origin' objects back and
(...skipping 10 matching lines...) Expand all
107 // and should NOT be used for IPC. Method takes std::strings for use with move 110 // and should NOT be used for IPC. Method takes std::strings for use with move
108 // operators to avoid copies. 111 // operators to avoid copies.
109 static Origin CreateFromNormalizedTupleWithSuborigin( 112 static Origin CreateFromNormalizedTupleWithSuborigin(
110 std::string scheme, 113 std::string scheme,
111 std::string host, 114 std::string host,
112 uint16_t port, 115 uint16_t port,
113 std::string suborigin); 116 std::string suborigin);
114 117
115 ~Origin(); 118 ~Origin();
116 119
117 // For unique origins, these return ("", "", 0). 120 // For opaque origins, these return ("", "", 0).
118 const std::string& scheme() const { return tuple_.scheme(); } 121 const std::string& scheme() const { return tuple_.scheme(); }
119 const std::string& host() const { return tuple_.host(); } 122 const std::string& host() const { return tuple_.host(); }
120 uint16_t port() const { return tuple_.port(); } 123 uint16_t port() const { return tuple_.port(); }
121 124
122 // Note that an origin without a suborgin will return the empty string. 125 // Note that an origin without a suborgin will return the empty string.
123 const std::string& suborigin() const { return suborigin_; } 126 const std::string& suborigin() const { return suborigin_; }
124 127
125 bool unique() const { return unique_; } 128 bool opaque() const { return opaque_; }
126 129
127 // An ASCII serialization of the Origin as per Section 6.2 of RFC 6454, with 130 // An ASCII serialization of the Origin as per Section 6.2 of RFC 6454, with
128 // the addition that all Origins with a 'file' scheme serialize to "file://". 131 // the addition that all Origins with a 'file' scheme serialize to "file://".
129 // If the Origin has a suborigin, it will be serialized per 132 // If the Origin has a suborigin, it will be serialized per
130 // https://w3c.github.io/webappsec-suborigins/#serializing. 133 // https://w3c.github.io/webappsec-suborigins/#serializing.
131 std::string Serialize() const; 134 std::string Serialize() const;
132 135
133 // Returns the physical origin for Origin. If the suborigin is empty, this 136 // Returns the physical origin for Origin. If the suborigin is empty, this
134 // will just return a copy of the Origin. If it has a suborigin, will return 137 // will just return a copy of the Origin. If it has a suborigin, will return
135 // the Origin of just the scheme/host/port tuple, without the suborigin. See 138 // the Origin of just the scheme/host/port tuple, without the suborigin. See
136 // https://w3c.github.io/webappsec-suborigins/. 139 // https://w3c.github.io/webappsec-suborigins/.
137 Origin GetPhysicalOrigin() const; 140 Origin GetPhysicalOrigin() const;
138 141
139 // Two Origins are "same-origin" if their schemes, hosts, and ports are exact 142 // Two Origins are "same-origin" if they are the same opaque origin, or if
140 // matches; and neither is unique. If either of the origins have suborigins, 143 // their schemes, hosts, and ports are exact matches; and neither is opaque.
141 // the suborigins also must be exact matches. 144 // If either of the origins have suborigins, the suborigins also must be exact
145 // matches.
142 bool IsSameOriginWith(const Origin& other) const; 146 bool IsSameOriginWith(const Origin& other) const;
143 bool operator==(const Origin& other) const { 147 bool operator==(const Origin& other) const {
144 return IsSameOriginWith(other); 148 return IsSameOriginWith(other);
145 } 149 }
146 150
147 // Same as above, but ignores suborigins if they exist. 151 // Same as above, but ignores suborigins if they exist.
148 bool IsSamePhysicalOriginWith(const Origin& other) const; 152 bool IsSamePhysicalOriginWith(const Origin& other) const;
149 153
150 // Efficiently returns what GURL(Serialize()) would without re-parsing the 154 // Efficiently returns what GURL(Serialize()) would without re-parsing the
151 // URL. This can be used for the (rare) times a GURL representation is needed 155 // URL. This can be used for the (rare) times a GURL representation is needed
(...skipping 16 matching lines...) Expand all
168 uint16_t port, 172 uint16_t port,
169 base::StringPiece suborigin, 173 base::StringPiece suborigin,
170 SchemeHostPort::ConstructPolicy policy); 174 SchemeHostPort::ConstructPolicy policy);
171 Origin(std::string scheme, 175 Origin(std::string scheme,
172 std::string host, 176 std::string host,
173 uint16_t port, 177 uint16_t port,
174 std::string suborigin, 178 std::string suborigin,
175 SchemeHostPort::ConstructPolicy policy); 179 SchemeHostPort::ConstructPolicy policy);
176 180
177 SchemeHostPort tuple_; 181 SchemeHostPort tuple_;
178 bool unique_; 182 bool opaque_;
179 std::string suborigin_; 183 std::string suborigin_;
180 }; 184 };
181 185
182 URL_EXPORT std::ostream& operator<<(std::ostream& out, const Origin& origin); 186 URL_EXPORT std::ostream& operator<<(std::ostream& out, const Origin& origin);
183 187
184 URL_EXPORT bool IsSameOriginWith(const GURL& a, const GURL& b); 188 URL_EXPORT bool IsSameOriginWith(const GURL& a, const GURL& b);
185 URL_EXPORT bool IsSamePhysicalOriginWith(const GURL& a, const GURL& b); 189 URL_EXPORT bool IsSamePhysicalOriginWith(const GURL& a, const GURL& b);
186 190
187 } // namespace url 191 } // namespace url
188 192
189 #endif // URL_ORIGIN_H_ 193 #endif // URL_ORIGIN_H_
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698