0
|
1 |
/*
|
|
2 |
* Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
|
|
3 |
*
|
|
4 |
* Redistribution and use in source and binary forms, with or without
|
|
5 |
* modification, are permitted provided that the following conditions
|
|
6 |
* are met:
|
|
7 |
* 1. Redistributions of source code must retain the above copyright
|
|
8 |
* notice, this list of conditions and the following disclaimer.
|
|
9 |
* 2. Redistributions in binary form must reproduce the above copyright
|
|
10 |
* notice, this list of conditions and the following disclaimer in the
|
|
11 |
* documentation and/or other materials provided with the distribution.
|
|
12 |
*
|
|
13 |
* THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
|
|
14 |
* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
15 |
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
|
16 |
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE COMPUTER, INC. OR
|
|
17 |
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
|
|
18 |
* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
|
|
19 |
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
|
|
20 |
* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
|
|
21 |
* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
22 |
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
|
23 |
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
24 |
*
|
|
25 |
*/
|
|
26 |
|
|
27 |
#include "config.h"
|
|
28 |
#include "CrossOriginPreflightResultCache.h"
|
|
29 |
|
|
30 |
#include "CrossOriginAccessControl.h"
|
|
31 |
#include "ResourceResponse.h"
|
|
32 |
#include <wtf/CurrentTime.h>
|
|
33 |
#include <wtf/StdLibExtras.h>
|
|
34 |
#include <wtf/Threading.h>
|
|
35 |
|
|
36 |
namespace WebCore {
|
|
37 |
|
|
38 |
// These values are at the discretion of the user agent.
|
|
39 |
static const unsigned defaultPreflightCacheTimeoutSeconds = 5;
|
|
40 |
static const unsigned maxPreflightCacheTimeoutSeconds = 600; // Should be short enough to minimize the risk of using a poisoned cache after switching to a secure network.
|
|
41 |
|
|
42 |
static bool parseAccessControlMaxAge(const String& string, unsigned& expiryDelta)
|
|
43 |
{
|
|
44 |
// FIXME: this will not do the correct thing for a number starting with a '+'
|
|
45 |
bool ok = false;
|
|
46 |
expiryDelta = string.toUIntStrict(&ok);
|
|
47 |
return ok;
|
|
48 |
}
|
|
49 |
|
|
50 |
template<class HashType>
|
|
51 |
static void addToAccessControlAllowList(const String& string, unsigned start, unsigned end, HashSet<String, HashType>& set)
|
|
52 |
{
|
|
53 |
StringImpl* stringImpl = string.impl();
|
|
54 |
if (!stringImpl)
|
|
55 |
return;
|
|
56 |
|
|
57 |
// Skip white space from start.
|
|
58 |
while (start <= end && isSpaceOrNewline((*stringImpl)[start]))
|
|
59 |
++start;
|
|
60 |
|
|
61 |
// only white space
|
|
62 |
if (start > end)
|
|
63 |
return;
|
|
64 |
|
|
65 |
// Skip white space from end.
|
|
66 |
while (end && isSpaceOrNewline((*stringImpl)[end]))
|
|
67 |
--end;
|
|
68 |
|
|
69 |
set.add(string.substring(start, end - start + 1));
|
|
70 |
}
|
|
71 |
|
|
72 |
template<class HashType>
|
|
73 |
static bool parseAccessControlAllowList(const String& string, HashSet<String, HashType>& set)
|
|
74 |
{
|
|
75 |
int start = 0;
|
|
76 |
int end;
|
|
77 |
while ((end = string.find(',', start)) != -1) {
|
|
78 |
if (start == end)
|
|
79 |
return false;
|
|
80 |
|
|
81 |
addToAccessControlAllowList(string, start, end - 1, set);
|
|
82 |
start = end + 1;
|
|
83 |
}
|
|
84 |
if (start != static_cast<int>(string.length()))
|
|
85 |
addToAccessControlAllowList(string, start, string.length() - 1, set);
|
|
86 |
|
|
87 |
return true;
|
|
88 |
}
|
|
89 |
|
|
90 |
bool CrossOriginPreflightResultCacheItem::parse(const ResourceResponse& response)
|
|
91 |
{
|
|
92 |
m_methods.clear();
|
|
93 |
if (!parseAccessControlAllowList(response.httpHeaderField("Access-Control-Allow-Methods"), m_methods))
|
|
94 |
return false;
|
|
95 |
|
|
96 |
m_headers.clear();
|
|
97 |
if (!parseAccessControlAllowList(response.httpHeaderField("Access-Control-Allow-Headers"), m_headers))
|
|
98 |
return false;
|
|
99 |
|
|
100 |
unsigned expiryDelta;
|
|
101 |
if (parseAccessControlMaxAge(response.httpHeaderField("Access-Control-Max-Age"), expiryDelta)) {
|
|
102 |
if (expiryDelta > maxPreflightCacheTimeoutSeconds)
|
|
103 |
expiryDelta = maxPreflightCacheTimeoutSeconds;
|
|
104 |
} else
|
|
105 |
expiryDelta = defaultPreflightCacheTimeoutSeconds;
|
|
106 |
|
|
107 |
m_absoluteExpiryTime = currentTime() + expiryDelta;
|
|
108 |
return true;
|
|
109 |
}
|
|
110 |
|
|
111 |
bool CrossOriginPreflightResultCacheItem::allowsCrossOriginMethod(const String& method) const
|
|
112 |
{
|
|
113 |
return m_methods.contains(method) || isOnAccessControlSimpleRequestMethodWhitelist(method);
|
|
114 |
}
|
|
115 |
|
|
116 |
bool CrossOriginPreflightResultCacheItem::allowsCrossOriginHeaders(const HTTPHeaderMap& requestHeaders) const
|
|
117 |
{
|
|
118 |
HTTPHeaderMap::const_iterator end = requestHeaders.end();
|
|
119 |
for (HTTPHeaderMap::const_iterator it = requestHeaders.begin(); it != end; ++it) {
|
|
120 |
if (!m_headers.contains(it->first) && !isOnAccessControlSimpleRequestHeaderWhitelist(it->first, it->second))
|
|
121 |
return false;
|
|
122 |
}
|
|
123 |
return true;
|
|
124 |
}
|
|
125 |
|
|
126 |
bool CrossOriginPreflightResultCacheItem::allowsRequest(bool includeCredentials, const String& method, const HTTPHeaderMap& requestHeaders) const
|
|
127 |
{
|
|
128 |
if (m_absoluteExpiryTime < currentTime())
|
|
129 |
return false;
|
|
130 |
if (includeCredentials && !m_credentials)
|
|
131 |
return false;
|
|
132 |
if (!allowsCrossOriginMethod(method))
|
|
133 |
return false;
|
|
134 |
if (!allowsCrossOriginHeaders(requestHeaders))
|
|
135 |
return false;
|
|
136 |
return true;
|
|
137 |
}
|
|
138 |
|
|
139 |
CrossOriginPreflightResultCache& CrossOriginPreflightResultCache::shared()
|
|
140 |
{
|
|
141 |
DEFINE_STATIC_LOCAL(CrossOriginPreflightResultCache, cache, ());
|
|
142 |
ASSERT(isMainThread());
|
|
143 |
return cache;
|
|
144 |
}
|
|
145 |
|
|
146 |
void CrossOriginPreflightResultCache::appendEntry(const String& origin, const KURL& url, CrossOriginPreflightResultCacheItem* preflightResult)
|
|
147 |
{
|
|
148 |
ASSERT(isMainThread());
|
|
149 |
m_preflightHashMap.set(std::make_pair(origin, url), preflightResult);
|
|
150 |
}
|
|
151 |
|
|
152 |
bool CrossOriginPreflightResultCache::canSkipPreflight(const String& origin, const KURL& url, bool includeCredentials, const String& method, const HTTPHeaderMap& requestHeaders)
|
|
153 |
{
|
|
154 |
ASSERT(isMainThread());
|
|
155 |
CrossOriginPreflightResultHashMap::iterator cacheIt = m_preflightHashMap.find(std::make_pair(origin, url));
|
|
156 |
if (cacheIt == m_preflightHashMap.end())
|
|
157 |
return false;
|
|
158 |
|
|
159 |
if (cacheIt->second->allowsRequest(includeCredentials, method, requestHeaders))
|
|
160 |
return true;
|
|
161 |
|
|
162 |
delete cacheIt->second;
|
|
163 |
m_preflightHashMap.remove(cacheIt);
|
|
164 |
return false;
|
|
165 |
}
|
|
166 |
|
|
167 |
void CrossOriginPreflightResultCache::empty()
|
|
168 |
{
|
|
169 |
ASSERT(isMainThread());
|
|
170 |
deleteAllValues(m_preflightHashMap);
|
|
171 |
m_preflightHashMap.clear();
|
|
172 |
}
|
|
173 |
|
|
174 |
} // namespace WebCore
|