Make net::DataURL's MIME string check stricter

content/child/web_url_loader_impl.cc

Index: content/child/web_url_loader_impl.cc
diff --git a/content/child/web_url_loader_impl.cc b/content/child/web_url_loader_impl.cc
index b11a537b8f7dd571434171aefdcc364b0fb37052..9e6b097a43d7e4a857d7ebddd965cc29df06c194 100644
--- a/content/child/web_url_loader_impl.cc
+++ b/content/child/web_url_loader_impl.cc
@@ -64,6 +64,59 @@ namespace content {
 
 // Utilities ------------------------------------------------------------------
 
+bool GetInfoFromDataURL(const GURL& url,
+                        ResourceResponseInfo* info,
+                        std::string* data,
+                        int* error_code) {
+  std::string mime_type;
+  std::string charset;
+  if (!net::DataURL::Parse(url, &mime_type, &charset, data)) {
+    *error_code = net::ERR_INVALID_URL;
+    return false;
+  }
+
+  DCHECK(!mime_type.empty());
+  DCHECK(!charset.empty());
+
+  // mime_type set by net::DataURL::Parse() is guaranteed to be in
+  //     token "/" token
+  // form. Now just ensure charset is token. The grammar for charset is not
+  // specially defined in RFC2045 and RFC2397. It just need to be token or
+  // quoted-string since it's an attibute value of media type. But charset in
+  // Content-Type header is specified explicitly to follow token ABNF in
+  // httpbis spec.
+  if (!net::HttpUtil::IsToken(charset)) {
+    *error_code = net::ERR_INVALID_URL;
+    return false;
+  }
+
+  *error_code = net::OK;
+  // Assure same time for all time fields of data: URLs.
+  Time now = Time::Now();
+  info->load_timing.request_start = TimeTicks::Now();
+  info->load_timing.request_start_time = now;
+  info->request_time = now;
+  info->response_time = now;
+
+  scoped_refptr<net::HttpResponseHeaders> headers(
+      new net::HttpResponseHeaders(std::string()));
+  headers->ReplaceStatusLine("HTTP/1.1 200 OK");
+  std::string content_type_header =
+      "Content-Type: " + mime_type + ";charset=" + charset;
+  headers->AddHeader(content_type_header);
+  headers->AddHeader("Access-Control-Allow-Origin: *");
+  headers->AddHeader("Access-Control-Allow-Credentials: true");
+  info->headers = headers;
+
+  info->mime_type.swap(mime_type);
+  info->charset.swap(charset);
+  info->security_info.clear();
+  info->content_length = data->length();
+  info->encoded_data_length = 0;
+
+  return true;
+}
+
 namespace {
 
 const char kThrottledErrorDescription[] =
@@ -123,35 +176,6 @@ class HeaderFlattener : public WebHTTPHeaderVisitor {
   bool has_accept_header_;
 };
 
-// Extracts the information from a data: url.
-bool GetInfoFromDataURL(const GURL& url,
-                        ResourceResponseInfo* info,
-                        std::string* data,
-                        int* error_code) {
-  std::string mime_type;
-  std::string charset;
-  if (net::DataURL::Parse(url, &mime_type, &charset, data)) {
-    *error_code = net::OK;
-    // Assure same time for all time fields of data: URLs.
-    Time now = Time::Now();
-    info->load_timing.request_start = TimeTicks::Now();
-    info->load_timing.request_start_time = now;
-    info->request_time = now;
-    info->response_time = now;
-    info->headers = NULL;
-    info->mime_type.swap(mime_type);
-    info->charset.swap(charset);
-    info->security_info.clear();
-    info->content_length = data->length();
-    info->encoded_data_length = 0;
-
-    return true;
-  }
-
-  *error_code = net::ERR_INVALID_URL;
-  return false;
-}
-
 typedef ResourceDevToolsInfo::HeadersVector HeadersVector;
 
 // Converts timing data from |load_timing| to the format used by WebKit.