OLD | NEW |
---|---|
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "content/browser/service_worker/service_worker_utils.h" | 5 #include "content/browser/service_worker/service_worker_utils.h" |
6 | 6 |
7 #include <string> | 7 #include <string> |
8 | 8 |
9 #include "base/logging.h" | 9 #include "base/logging.h" |
10 #include "base/strings/string_util.h" | 10 #include "base/strings/string_util.h" |
11 | 11 |
12 namespace content { | 12 namespace content { |
13 | 13 |
14 namespace { | 14 namespace { |
15 | 15 |
16 const char kDisallowedCharacterErrorMessage[] = | |
17 "The scope/script URL includes disallowed escaped character."; | |
18 const char kPathRestrictionErrorMessage[] = | |
19 "The scope must be under the directory of the script URL."; | |
20 | |
21 bool ContainsDisallowedCharacter(const GURL& url) { | 16 bool ContainsDisallowedCharacter(const GURL& url) { |
22 std::string path = url.path(); | 17 std::string path = url.path(); |
23 DCHECK(base::IsStringUTF8(path)); | 18 DCHECK(base::IsStringUTF8(path)); |
24 | 19 |
25 // We should avoid these escaped characters in the path component because | 20 // We should avoid these escaped characters in the path component because |
26 // these can be handled differently depending on server implementation. | 21 // these can be handled differently depending on server implementation. |
27 if (path.find("%2f") != std::string::npos || | 22 if (path.find("%2f") != std::string::npos || |
28 path.find("%2F") != std::string::npos) { | 23 path.find("%2F") != std::string::npos) { |
29 return true; | 24 return true; |
30 } | 25 } |
(...skipping 27 matching lines...) Expand all Loading... | |
58 const GURL& script_url, | 53 const GURL& script_url, |
59 std::string* error_message) { | 54 std::string* error_message) { |
60 DCHECK(scope.is_valid()); | 55 DCHECK(scope.is_valid()); |
61 DCHECK(!scope.has_ref()); | 56 DCHECK(!scope.has_ref()); |
62 DCHECK(script_url.is_valid()); | 57 DCHECK(script_url.is_valid()); |
63 DCHECK(!script_url.has_ref()); | 58 DCHECK(!script_url.has_ref()); |
64 DCHECK(error_message); | 59 DCHECK(error_message); |
65 | 60 |
66 if (ContainsDisallowedCharacter(scope) || | 61 if (ContainsDisallowedCharacter(scope) || |
67 ContainsDisallowedCharacter(script_url)) { | 62 ContainsDisallowedCharacter(script_url)) { |
68 *error_message = kDisallowedCharacterErrorMessage; | 63 *error_message = "The provided scope ('" + scope.spec() + |
64 "') or scriptURL ('" + script_url.spec() + | |
dominicc (has gone to gerrit)
2015/01/14 06:16:38
script URL
with a space? WDYT?
dominicc (has gone to gerrit)
2015/01/14 06:16:38
script URL
with a space? Ditto below. WDYT?
dominicc (has gone to gerrit)
2015/01/14 06:16:38
script URL
with a space? WDYT?
falken
2015/01/14 07:29:21
I like "scriptURL" as it's the parameter to Servic
| |
65 "') includes a disallowed escape character."; | |
69 return false; | 66 return false; |
70 } | 67 } |
71 | 68 |
72 // |scope|'s path should be under the |script_url|'s directory. | 69 // |scope|'s path should be under the |script_url|'s directory. |
73 if (!StartsWithASCII(scope.path(), GetDirectoryPath(script_url), true)) { | 70 if (!StartsWithASCII(scope.path(), GetDirectoryPath(script_url), true)) { |
74 *error_message = kPathRestrictionErrorMessage; | 71 *error_message = |
72 "The path of the provided scope ('" + scope.spec() + | |
73 "') is not under the directory of the provided scriptURL ('" + | |
74 script_url.spec() + "')."; | |
75 return false; | 75 return false; |
76 } | 76 } |
77 return true; | 77 return true; |
78 } | 78 } |
79 | 79 |
80 bool LongestScopeMatcher::MatchLongest(const GURL& scope) { | 80 bool LongestScopeMatcher::MatchLongest(const GURL& scope) { |
81 if (!ServiceWorkerUtils::ScopeMatches(scope, url_)) | 81 if (!ServiceWorkerUtils::ScopeMatches(scope, url_)) |
82 return false; | 82 return false; |
83 if (match_.is_empty() || match_.spec().size() < scope.spec().size()) { | 83 if (match_.is_empty() || match_.spec().size() < scope.spec().size()) { |
84 match_ = scope; | 84 match_ = scope; |
85 return true; | 85 return true; |
86 } | 86 } |
87 return false; | 87 return false; |
88 } | 88 } |
89 | 89 |
90 } // namespace content | 90 } // namespace content |
OLD | NEW |