OLD | NEW |
| (Empty) |
1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #ifndef NET_BASE_DATA_URL_H_ | |
6 #define NET_BASE_DATA_URL_H_ | |
7 | |
8 #include <string> | |
9 | |
10 #include "net/base/net_export.h" | |
11 | |
12 class GURL; | |
13 | |
14 namespace net { | |
15 | |
16 // See RFC 2397 for a complete description of the 'data' URL scheme. | |
17 // | |
18 // Briefly, a 'data' URL has the form: | |
19 // | |
20 // data:[<mediatype>][;base64],<data> | |
21 // | |
22 // The <mediatype> is an Internet media type specification (with optional | |
23 // parameters.) The appearance of ";base64" means that the data is encoded as | |
24 // base64. Without ";base64", the data (as a sequence of octets) is represented | |
25 // using ASCII encoding for octets inside the range of safe URL characters and | |
26 // using the standard %xx hex encoding of URLs for octets outside that range. | |
27 // If <mediatype> is omitted, it defaults to text/plain;charset=US-ASCII. As a | |
28 // shorthand, "text/plain" can be omitted but the charset parameter supplied. | |
29 // | |
30 class NET_EXPORT DataURL { | |
31 public: | |
32 // This method can be used to parse a 'data' URL into its component pieces. | |
33 // | |
34 // The resulting mime_type is normalized to lowercase. The data is the | |
35 // decoded data (e.g.., if the data URL specifies base64 encoding, then the | |
36 // returned data is base64 decoded, and any %-escaped bytes are unescaped). | |
37 // | |
38 // If the media type value doesn't match the media-type production defined in | |
39 // RFC 7231, mime_type will be set to the default value "text/plain". We | |
40 // don't simply fail for this grammar violation since Chromium had been | |
41 // accepting such invalid values. For example, <img> element with the src | |
42 // attribute set to a data URL with an invalid media type "image" (without a | |
43 // slash and subtype) had been displayed. However, the value this method will | |
44 // store in mime_type argument can be used for generating other headers, etc. | |
45 // This could lead to security vulnerability. We don't want to accept | |
46 // arbitrary value and ask each caller to validate the return value. | |
47 // | |
48 // If the charset parameter is specified but its value doesn't match the | |
49 // token production defined in RFC 7230, this method simply fails and returns | |
50 // false. | |
51 // | |
52 // If there's any other grammar violation in the URL, then this method will | |
53 // return false. Output variables may be changed and contain invalid data. On | |
54 // success, true is returned. | |
55 // | |
56 // OPTIONAL: If |data| is NULL, then the <data> section will not be parsed | |
57 // or validated. | |
58 // | |
59 static bool Parse(const GURL& url, | |
60 std::string* mime_type, | |
61 std::string* charset, | |
62 std::string* data); | |
63 }; | |
64 | |
65 } // namespace net | |
66 | |
67 #endif // NET_BASE_DATA_URL_H_ | |
OLD | NEW |