| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "config.h" | 5 #include "config.h" |
| 6 #include "FetchHeaderList.h" | 6 #include "FetchHeaderList.h" |
| 7 | 7 |
| 8 #include "core/fetch/CrossOriginAccessControl.h" | 8 #include "core/fetch/FetchUtils.h" |
| 9 #include "core/xml/XMLHttpRequest.h" | |
| 10 #include "platform/network/HTTPParsers.h" | 9 #include "platform/network/HTTPParsers.h" |
| 11 #include "wtf/PassOwnPtr.h" | 10 #include "wtf/PassOwnPtr.h" |
| 12 | 11 |
| 13 namespace blink { | 12 namespace blink { |
| 14 | 13 |
| 15 PassRefPtrWillBeRawPtr<FetchHeaderList> FetchHeaderList::create() | 14 PassRefPtrWillBeRawPtr<FetchHeaderList> FetchHeaderList::create() |
| 16 { | 15 { |
| 17 return adoptRefWillBeNoop(new FetchHeaderList()); | 16 return adoptRefWillBeNoop(new FetchHeaderList()); |
| 18 } | 17 } |
| 19 | 18 |
| (...skipping 97 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 117 } | 116 } |
| 118 | 117 |
| 119 void FetchHeaderList::clearList() | 118 void FetchHeaderList::clearList() |
| 120 { | 119 { |
| 121 m_headerList.clear(); | 120 m_headerList.clear(); |
| 122 } | 121 } |
| 123 | 122 |
| 124 bool FetchHeaderList::containsNonSimpleHeader() const | 123 bool FetchHeaderList::containsNonSimpleHeader() const |
| 125 { | 124 { |
| 126 for (size_t i = 0; i < m_headerList.size(); ++i) { | 125 for (size_t i = 0; i < m_headerList.size(); ++i) { |
| 127 if (!isSimpleHeader(m_headerList[i]->first, m_headerList[i]->second)) | 126 if (!FetchUtils::isSimpleHeader(AtomicString(m_headerList[i]->first), At
omicString(m_headerList[i]->second))) |
| 128 return true; | 127 return true; |
| 129 } | 128 } |
| 130 return false; | 129 return false; |
| 131 } | 130 } |
| 132 | 131 |
| 133 bool FetchHeaderList::isValidHeaderName(const String& name) | 132 bool FetchHeaderList::isValidHeaderName(const String& name) |
| 134 { | 133 { |
| 135 // "A name is a case-insensitive byte sequence that matches the field-name | 134 // "A name is a case-insensitive byte sequence that matches the field-name |
| 136 // token production." | 135 // token production." |
| 137 return isValidHTTPToken(name); | 136 return isValidHTTPToken(name); |
| 138 } | 137 } |
| 139 | 138 |
| 140 bool FetchHeaderList::isValidHeaderValue(const String& value) | 139 bool FetchHeaderList::isValidHeaderValue(const String& value) |
| 141 { | 140 { |
| 142 // "A value is a byte sequence that matches the field-value token production | 141 // "A value is a byte sequence that matches the field-value token production |
| 143 // and contains no 0x0A or 0x0D bytes." | 142 // and contains no 0x0A or 0x0D bytes." |
| 144 return isValidHTTPHeaderValue(value); | 143 return isValidHTTPHeaderValue(value); |
| 145 } | 144 } |
| 146 | 145 |
| 147 bool FetchHeaderList::isSimpleHeader(const String& name, const String& value) | |
| 148 { | |
| 149 // "A simple header is a header whose name is either one of `Accept`, | |
| 150 // `Accept-Language`, and `Content-Language`, or whose name is | |
| 151 // `Content-Type` and value, once parsed, is one of | |
| 152 // `application/x-www-form-urlencoded`, `multipart/form-data`, and | |
| 153 // `text/plain`." | |
| 154 if (equalIgnoringCase(name, "accept") | |
| 155 || equalIgnoringCase(name, "accept-language") | |
| 156 || equalIgnoringCase(name, "content-language")) | |
| 157 return true; | |
| 158 | |
| 159 if (equalIgnoringCase(name, "content-type")) { | |
| 160 AtomicString mimeType = extractMIMETypeFromMediaType(AtomicString(value)
); | |
| 161 return equalIgnoringCase(mimeType, "application/x-www-form-urlencoded") | |
| 162 || equalIgnoringCase(mimeType, "multipart/form-data") | |
| 163 || equalIgnoringCase(mimeType, "text/plain"); | |
| 164 } | |
| 165 | |
| 166 return false; | |
| 167 } | |
| 168 | |
| 169 bool FetchHeaderList::isForbiddenHeaderName(const String& name) | |
| 170 { | |
| 171 // "A forbidden header name is a header names that is one of: | |
| 172 // `Accept-Charset`, `Accept-Encoding`, `Access-Control-Request-Headers`, | |
| 173 // `Access-Control-Request-Method`, `Connection`, | |
| 174 // `Content-Length, Cookie`, `Cookie2`, `Date`, `DNT`, `Expect`, `Host`, | |
| 175 // `Keep-Alive`, `Origin`, `Referer`, `TE`, `Trailer`, | |
| 176 // `Transfer-Encoding`, `Upgrade`, `User-Agent`, `Via` | |
| 177 // or starts with `Proxy-` or `Sec-` (including when it is just `Proxy-` or | |
| 178 // `Sec-`)." | |
| 179 return !XMLHttpRequest::isAllowedHTTPHeader(name) || equalIgnoringCase(name,
"DNT"); | |
| 180 } | |
| 181 | |
| 182 bool FetchHeaderList::isForbiddenResponseHeaderName(const String& name) | |
| 183 { | |
| 184 // "A forbidden response header name is a header name that is one of: | |
| 185 // `Set-Cookie`, `Set-Cookie2`" | |
| 186 return equalIgnoringCase(name, "set-cookie") || equalIgnoringCase(name, "set
-cookie2"); | |
| 187 } | |
| 188 | |
| 189 } // namespace blink | 146 } // namespace blink |
| OLD | NEW |