Make net::DataURL's MIME string check stricter

content/child/web_url_loader_impl.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // An implementation of WebURLLoader in terms of ResourceLoaderBridge.
 
 #include "content/child/web_url_loader_impl.h"
 
 #include "base/bind.h"
 #include "base/files/file_path.h"
@@ skipping 46 matching lines @@
 using webkit_glue::MultipartResponseDelegate;
 using webkit_glue::ResourceDevToolsInfo;
 using webkit_glue::ResourceLoaderBridge;
 using webkit_glue::ResourceResponseInfo;
 using webkit_glue::WebURLResponseExtraDataImpl;
 
 namespace content {
 
 // Utilities ------------------------------------------------------------------
 
+bool GetInfoFromDataURL(const GURL& url,
+                        ResourceResponseInfo* info,
+                        std::string* data,
+                        int* error_code) {
+  std::string mime_type;
+  std::string charset;
+  if (!net::DataURL::Parse(url, &mime_type, &charset, data)) {
+    *error_code = net::ERR_INVALID_URL;
+    return false;
+  }
+
+  DCHECK(!mime_type.empty());
+  DCHECK(!charset.empty());
+
+  // mime_type set by net::DataURL::Parse() is guaranteed to be in
+  //     token "/" token
+  // form. Now just ensure charset is token. The grammar for charset is not
+  // specially defined in RFC2045 and RFC2397. It just need to be token or
+  // quoted-string since it's an attibute value of media type. But charset in
+  // Content-Type header is specified explicitly to follow token ABNF in
+  // httpbis spec.
+  if (!net::HttpUtil::IsToken(charset)) {
+    *error_code = net::ERR_INVALID_URL;
+    return false;
+  }
+
+  *error_code = net::OK;
+  // Assure same time for all time fields of data: URLs.
+  Time now = Time::Now();
+  info->load_timing.request_start = TimeTicks::Now();
+  info->load_timing.request_start_time = now;
+  info->request_time = now;
+  info->response_time = now;
+
+  scoped_refptr<net::HttpResponseHeaders> headers(
+      new net::HttpResponseHeaders(std::string()));
+  headers->ReplaceStatusLine("HTTP/1.1 200 OK");
+  std::string content_type_header =
+      "Content-Type: " + mime_type + ";charset=" + charset;
+  headers->AddHeader(content_type_header);
+  headers->AddHeader("Access-Control-Allow-Origin: *");
+  headers->AddHeader("Access-Control-Allow-Credentials: true");
+  info->headers = headers;
+
+  info->mime_type.swap(mime_type);
+  info->charset.swap(charset);
+  info->security_info.clear();
+  info->content_length = data->length();
+  info->encoded_data_length = 0;
+
+  return true;
+}
+
 namespace {
 
 const char kThrottledErrorDescription[] =
     "Request throttled. Visit http://dev.chromium.org/throttling for more "
     "information.";
 
 class HeaderFlattener : public WebHTTPHeaderVisitor {
  public:
   explicit HeaderFlattener(int load_flags)
       : load_flags_(load_flags),
@@ skipping 39 matching lines @@
     }
     return buffer_;
   }
 
  private:
   int load_flags_;
   std::string buffer_;
   bool has_accept_header_;
 };
 
-// Extracts the information from a data: url.
-bool GetInfoFromDataURL(const GURL& url,
-                        ResourceResponseInfo* info,
-                        std::string* data,
-                        int* error_code) {
-  std::string mime_type;
-  std::string charset;
-  if (net::DataURL::Parse(url, &mime_type, &charset, data)) {
-    *error_code = net::OK;
-    // Assure same time for all time fields of data: URLs.
-    Time now = Time::Now();
-    info->load_timing.request_start = TimeTicks::Now();
-    info->load_timing.request_start_time = now;
-    info->request_time = now;
-    info->response_time = now;
-    info->headers = NULL;
-    info->mime_type.swap(mime_type);
-    info->charset.swap(charset);
-    info->security_info.clear();
-    info->content_length = data->length();
-    info->encoded_data_length = 0;
-
-    return true;
-  }
-
-  *error_code = net::ERR_INVALID_URL;
-  return false;
-}
-
 typedef ResourceDevToolsInfo::HeadersVector HeadersVector;
 
 // Converts timing data from |load_timing| to the format used by WebKit.
 void PopulateURLLoadTiming(const net::LoadTimingInfo& load_timing,
                            WebURLLoadTiming* url_timing) {
   DCHECK(!load_timing.request_start.is_null());
 
   const TimeTicks kNullTicks;
   url_timing->initialize();
   url_timing->setRequestTime(
@@ skipping 699 matching lines @@
 
 void WebURLLoaderImpl::setDefersLoading(bool value) {
   context_->SetDefersLoading(value);
 }
 
 void WebURLLoaderImpl::didChangePriority(WebURLRequest::Priority new_priority) {
   context_->DidChangePriority(new_priority);
 }
 
 }  // namespace content