/*

 *  Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.

 *  Copyright (C) 2005-2007 Alexey Proskuryakov <ap@webkit.org>

 *  Copyright (C) 2007, 2008 Julien Chaffraix <jchaffraix@webkit.org>

 *  Copyright (C) 2008 David Levin <levin@chromium.org>

 *

 *  This library is free software; you can redistribute it and/or

 *  modify it under the terms of the GNU Lesser General Public

 *  License as published by the Free Software Foundation; either

 *  version 2 of the License, or (at your option) any later version.

 *

 *  This library is distributed in the hope that it will be useful,

 *  but WITHOUT ANY WARRANTY; without even the implied warranty of

 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 *  Lesser General Public License for more details.

 *

 *  You should have received a copy of the GNU Lesser General Public

 *  License along with this library; if not, write to the Free Software

 *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA

 */

#include "config.h"

#include "XMLHttpRequest.h"

#include "Blob.h"

#include "Cache.h"

#include "CrossOriginAccessControl.h"

#include "DOMFormData.h"

#include "DOMImplementation.h"

#include "Document.h"

#include "Event.h"

#include "EventException.h"

#include "EventListener.h"

#include "EventNames.h"

#include "HTTPParsers.h"

#include "InspectorController.h"

#include "InspectorTimelineAgent.h"

#include "ResourceError.h"

#include "ResourceRequest.h"

#include "SecurityOrigin.h"

#include "Settings.h"

#include "TextResourceDecoder.h"

#include "ThreadableLoader.h"

#include "XMLHttpRequestException.h"

#include "XMLHttpRequestProgressEvent.h"

#include "XMLHttpRequestUpload.h"

#include "markup.h"

#include <wtf/text/CString.h>

#include <wtf/StdLibExtras.h>

#include <wtf/RefCountedLeakCounter.h>

#if USE(JSC)

#include "JSDOMBinding.h"

#include "JSDOMWindow.h"

#include <runtime/Protect.h>

#endif

namespace WebCore {

#ifndef NDEBUG

static WTF::RefCountedLeakCounter xmlHttpRequestCounter("XMLHttpRequest");

#endif

struct XMLHttpRequestStaticData : Noncopyable {

    XMLHttpRequestStaticData();

    String m_proxyHeaderPrefix;

    String m_secHeaderPrefix;

    HashSet<String, CaseFoldingHash> m_forbiddenRequestHeaders;

};

XMLHttpRequestStaticData::XMLHttpRequestStaticData()

    : m_proxyHeaderPrefix("proxy-")

    , m_secHeaderPrefix("sec-")

{

    m_forbiddenRequestHeaders.add("accept-charset");

    m_forbiddenRequestHeaders.add("accept-encoding");

    m_forbiddenRequestHeaders.add("access-control-request-headers");

    m_forbiddenRequestHeaders.add("access-control-request-method");

    m_forbiddenRequestHeaders.add("connection");

    m_forbiddenRequestHeaders.add("content-length");

    m_forbiddenRequestHeaders.add("content-transfer-encoding");

    m_forbiddenRequestHeaders.add("cookie");

    m_forbiddenRequestHeaders.add("cookie2");

    m_forbiddenRequestHeaders.add("date");

    m_forbiddenRequestHeaders.add("expect");

    m_forbiddenRequestHeaders.add("host");

    m_forbiddenRequestHeaders.add("keep-alive");

    m_forbiddenRequestHeaders.add("origin");

    m_forbiddenRequestHeaders.add("referer");

    m_forbiddenRequestHeaders.add("te");

    m_forbiddenRequestHeaders.add("trailer");

    m_forbiddenRequestHeaders.add("transfer-encoding");

    m_forbiddenRequestHeaders.add("upgrade");

    m_forbiddenRequestHeaders.add("user-agent");

    m_forbiddenRequestHeaders.add("via");

}

// Determines if a string is a valid token, as defined by

// "token" in section 2.2 of RFC 2616.

static bool isValidToken(const String& name)

{

    unsigned length = name.length();

    for (unsigned i = 0; i < length; i++) {

        UChar c = name[i];

        if (c >= 127 || c <= 32)

            return false;

        if (c == '(' || c == ')' || c == '<' || c == '>' || c == '@' ||

            c == ',' || c == ';' || c == ':' || c == '\\' || c == '\"' ||

            c == '/' || c == '[' || c == ']' || c == '?' || c == '=' ||

            c == '{' || c == '}')

            return false;

    }

    return true;

}

static bool isValidHeaderValue(const String& name)

{

    // FIXME: This should really match name against

    // field-value in section 4.2 of RFC 2616.

    return !name.contains('\r') && !name.contains('\n');

}

static bool isSetCookieHeader(const AtomicString& name)

{

    return equalIgnoringCase(name, "set-cookie") || equalIgnoringCase(name, "set-cookie2");

}

static void setCharsetInMediaType(String& mediaType, const String& charsetValue)

{

    unsigned int pos = 0, len = 0;

    findCharsetInMediaType(mediaType, pos, len);

    if (!len) {

        // When no charset found, append new charset.

        mediaType.stripWhiteSpace();

        if (mediaType[mediaType.length() - 1] != ';')

            mediaType.append(";");

        mediaType.append(" charset=");

        mediaType.append(charsetValue);

    } else {

        // Found at least one existing charset, replace all occurrences with new charset.

        while (len) {

            mediaType.replace(pos, len, charsetValue);

            unsigned int start = pos + charsetValue.length();

            findCharsetInMediaType(mediaType, pos, len, start);

        }

    }

}

static const XMLHttpRequestStaticData* staticData = 0;

static const XMLHttpRequestStaticData* createXMLHttpRequestStaticData()

{

    staticData = new XMLHttpRequestStaticData;

    return staticData;

}

static const XMLHttpRequestStaticData* initializeXMLHttpRequestStaticData()

{

    // Uses dummy to avoid warnings about an unused variable.

    AtomicallyInitializedStatic(const XMLHttpRequestStaticData*, dummy = createXMLHttpRequestStaticData());

    return dummy;

}

XMLHttpRequest::XMLHttpRequest(ScriptExecutionContext* context)

    : ActiveDOMObject(context, this)

    , m_async(true)

    , m_includeCredentials(false)

    , m_state(UNSENT)

    , m_responseText("")

    , m_createdDocument(false)

    , m_error(false)

    , m_uploadEventsAllowed(true)

    , m_uploadComplete(false)

    , m_sameOriginRequest(true)

    , m_didTellLoaderAboutRequest(false)

    , m_receivedLength(0)

    , m_lastSendLineNumber(0)

    , m_exceptionCode(0)

    , m_progressEventThrottle(this)

{

    initializeXMLHttpRequestStaticData();

#ifndef NDEBUG

    xmlHttpRequestCounter.increment();

#endif

}

XMLHttpRequest::~XMLHttpRequest()

{

    if (m_didTellLoaderAboutRequest) {

        cache()->loader()->nonCacheRequestComplete(m_url);

        m_didTellLoaderAboutRequest = false;

    }

    if (m_upload)

        m_upload->disconnectXMLHttpRequest();

#ifndef NDEBUG

    xmlHttpRequestCounter.decrement();

#endif

}

Document* XMLHttpRequest::document() const

{

    ASSERT(scriptExecutionContext()->isDocument());

    return static_cast<Document*>(scriptExecutionContext());

}

#if ENABLE(DASHBOARD_SUPPORT)

bool XMLHttpRequest::usesDashboardBackwardCompatibilityMode() const

{

    if (scriptExecutionContext()->isWorkerContext())

        return false;

    Settings* settings = document()->settings();

    return settings && settings->usesDashboardBackwardCompatibilityMode();

}

#endif

XMLHttpRequest::State XMLHttpRequest::readyState() const

{

    return m_state;

}

const ScriptString& XMLHttpRequest::responseText() const

{

    return m_responseText;

}

Document* XMLHttpRequest::responseXML() const

{

    if (m_state != DONE)

        return 0;

    if (!m_createdDocument) {

        if ((m_response.isHTTP() && !responseIsXML()) || scriptExecutionContext()->isWorkerContext()) {

            // The W3C spec requires this.

            m_responseXML = 0;

        } else {

            m_responseXML = Document::create(0, m_url);

            m_responseXML->open();

            // FIXME: Set Last-Modified.

            m_responseXML->write(String(m_responseText));

            m_responseXML->finishParsing();

            m_responseXML->close();

            if (!m_responseXML->wellFormed())

                m_responseXML = 0;

        }

        m_createdDocument = true;

    }

    return m_responseXML.get();

}

XMLHttpRequestUpload* XMLHttpRequest::upload()

{

    if (!m_upload)

        m_upload = XMLHttpRequestUpload::create(this);

    return m_upload.get();

}

void XMLHttpRequest::changeState(State newState)

{

    if (m_state != newState) {

        m_state = newState;

        callReadyStateChangeListener();

    }

}

void XMLHttpRequest::callReadyStateChangeListener()

{

    if (!scriptExecutionContext())

        return;

#if ENABLE(INSPECTOR)

    InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(scriptExecutionContext());

    bool callTimelineAgentOnReadyStateChange = timelineAgent && hasEventListeners(eventNames().readystatechangeEvent);

    if (callTimelineAgentOnReadyStateChange)

        timelineAgent->willChangeXHRReadyState(m_url.string(), m_state);

#endif

    if (m_async || (m_state <= OPENED || m_state == DONE))

        m_progressEventThrottle.dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().readystatechangeEvent), m_state == DONE ? FlushProgressEvent : DoNotFlushProgressEvent);

#if ENABLE(INSPECTOR)

    if (callTimelineAgentOnReadyStateChange && (timelineAgent = InspectorTimelineAgent::retrieve(scriptExecutionContext())))

        timelineAgent->didChangeXHRReadyState();

#endif

    if (m_state == DONE && !m_error) {

#if ENABLE(INSPECTOR)

        timelineAgent = InspectorTimelineAgent::retrieve(scriptExecutionContext());

        bool callTimelineAgentOnLoad = timelineAgent && hasEventListeners(eventNames().loadEvent);

        if (callTimelineAgentOnLoad)

            timelineAgent->willLoadXHR(m_url.string());

#endif

        m_progressEventThrottle.dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().loadEvent));

#if ENABLE(INSPECTOR)

        if (callTimelineAgentOnLoad && (timelineAgent = InspectorTimelineAgent::retrieve(scriptExecutionContext())))

            timelineAgent->didLoadXHR();

#endif

    }

}

void XMLHttpRequest::setWithCredentials(bool value, ExceptionCode& ec)

{

    if (m_state != OPENED || m_loader) {

        ec = INVALID_STATE_ERR;

        return;

    }

    m_includeCredentials = value;

}

void XMLHttpRequest::open(const String& method, const KURL& url, ExceptionCode& ec)

{

    open(method, url, true, ec);

}

void XMLHttpRequest::open(const String& method, const KURL& url, bool async, ExceptionCode& ec)

{

    internalAbort();

    State previousState = m_state;

    m_state = UNSENT;

    m_error = false;

    m_uploadComplete = false;

    // clear stuff from possible previous load

    clearResponse();

    clearRequest();

    ASSERT(m_state == UNSENT);

    if (!isValidToken(method)) {

        ec = SYNTAX_ERR;

        return;

    }

    // Method names are case sensitive. But since Firefox uppercases method names it knows, we'll do the same.

    String methodUpper(method.upper());

    if (methodUpper == "TRACE" || methodUpper == "TRACK" || methodUpper == "CONNECT") {

        ec = SECURITY_ERR;

        return;

    }

    m_url = url;

    if (methodUpper == "COPY" || methodUpper == "DELETE" || methodUpper == "GET" || methodUpper == "HEAD"

        || methodUpper == "INDEX" || methodUpper == "LOCK" || methodUpper == "M-POST" || methodUpper == "MKCOL" || methodUpper == "MOVE"

        || methodUpper == "OPTIONS" || methodUpper == "POST" || methodUpper == "PROPFIND" || methodUpper == "PROPPATCH" || methodUpper == "PUT"

        || methodUpper == "UNLOCK")

        m_method = methodUpper;

    else

        m_method = method;

    m_async = async;

    ASSERT(!m_loader);

    // Check previous state to avoid dispatching readyState event

    // when calling open several times in a row.

    if (previousState != OPENED)

        changeState(OPENED);

    else

        m_state = OPENED;

}

void XMLHttpRequest::open(const String& method, const KURL& url, bool async, const String& user, ExceptionCode& ec)

{

    KURL urlWithCredentials(url);

    urlWithCredentials.setUser(user);

    open(method, urlWithCredentials, async, ec);

}

void XMLHttpRequest::open(const String& method, const KURL& url, bool async, const String& user, const String& password, ExceptionCode& ec)

{

    KURL urlWithCredentials(url);

    urlWithCredentials.setUser(user);

    urlWithCredentials.setPass(password);

    open(method, urlWithCredentials, async, ec);

}

bool XMLHttpRequest::initSend(ExceptionCode& ec)

{

    if (!scriptExecutionContext())

        return false;

    if (m_state != OPENED || m_loader) {

        ec = INVALID_STATE_ERR;

        return false;

    }

    m_error = false;

    return true;

}

void XMLHttpRequest::send(ExceptionCode& ec)

{

    send(String(), ec);

}

void XMLHttpRequest::send(Document* document, ExceptionCode& ec)

{

    ASSERT(document);

    if (!initSend(ec))

        return;

    if (m_method != "GET" && m_method != "HEAD" && m_url.protocolInHTTPFamily()) {

        String contentType = getRequestHeader("Content-Type");

        if (contentType.isEmpty()) {

#if ENABLE(DASHBOARD_SUPPORT)

            if (usesDashboardBackwardCompatibilityMode())

                setRequestHeaderInternal("Content-Type", "application/x-www-form-urlencoded");

            else

#endif

                // FIXME: this should include the charset used for encoding.

                setRequestHeaderInternal("Content-Type", "application/xml");

        }

        // FIXME: According to XMLHttpRequest Level 2, this should use the Document.innerHTML algorithm

        // from the HTML5 specification to serialize the document.

        String body = createMarkup(document);

        // FIXME: this should use value of document.inputEncoding to determine the encoding to use.

        TextEncoding encoding = UTF8Encoding();

        m_requestEntityBody = FormData::create(encoding.encode(body.characters(), body.length(), EntitiesForUnencodables));

        if (m_upload)

            m_requestEntityBody->setAlwaysStream(true);

    }

    createRequest(ec);

}

void XMLHttpRequest::send(const String& body, ExceptionCode& ec)

{

    if (!initSend(ec))

        return;

    if (!body.isNull() && m_method != "GET" && m_method != "HEAD" && m_url.protocolInHTTPFamily()) {

        String contentType = getRequestHeader("Content-Type");

        if (contentType.isEmpty()) {

#if ENABLE(DASHBOARD_SUPPORT)

            if (usesDashboardBackwardCompatibilityMode())

                setRequestHeaderInternal("Content-Type", "application/x-www-form-urlencoded");

            else

#endif

                setRequestHeaderInternal("Content-Type", "application/xml");

        } else {

            setCharsetInMediaType(contentType, "UTF-8");

            m_requestHeaders.set("Content-Type", contentType);

        }

        m_requestEntityBody = FormData::create(UTF8Encoding().encode(body.characters(), body.length(), EntitiesForUnencodables));

        if (m_upload)

            m_requestEntityBody->setAlwaysStream(true);

    }

    createRequest(ec);

}

void XMLHttpRequest::send(Blob* body, ExceptionCode& ec)

{

    if (!initSend(ec))

        return;

    if (m_method != "GET" && m_method != "HEAD" && m_url.protocolInHTTPFamily()) {

        // FIXME: Should we set a Content-Type if one is not set.

        // FIXME: add support for uploading bundles.

        m_requestEntityBody = FormData::create();

        m_requestEntityBody->appendItems(body->items());

    }

    createRequest(ec);

}

void XMLHttpRequest::send(DOMFormData* body, ExceptionCode& ec)

{

    if (!initSend(ec))

        return;

    if (m_method != "GET" && m_method != "HEAD" && m_url.protocolInHTTPFamily()) {

        m_requestEntityBody = FormData::createMultiPart(body->items(), body->encoding(), document());

        // We need to ask the client to provide the generated file names if needed. When FormData fills the element

        // for the file, it could set a flag to use the generated file name, i.e. a package file on Mac.

        m_requestEntityBody->generateFiles(document());

        String contentType = getRequestHeader("Content-Type");

        if (contentType.isEmpty()) {

            contentType = "multipart/form-data; boundary=";

            contentType += m_requestEntityBody->boundary().data();

            setRequestHeaderInternal("Content-Type", contentType);

        }

    }

    createRequest(ec);

}

void XMLHttpRequest::createRequest(ExceptionCode& ec)

{

    // The presence of upload event listeners forces us to use preflighting because POSTing to an URL that does not

    // permit cross origin requests should look exactly like POSTing to an URL that does not respond at all.

    // Also, only async requests support upload progress events.

    bool uploadEvents = false;

    if (m_async) {

        m_progressEventThrottle.dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().loadstartEvent));

        if (m_requestEntityBody && m_upload) {

            uploadEvents = m_upload->hasEventListeners();

            m_upload->dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().loadstartEvent));

        }

    }

    m_sameOriginRequest = scriptExecutionContext()->securityOrigin()->canRequest(m_url);

    // We also remember whether upload events should be allowed for this request in case the upload listeners are

    // added after the request is started.

    m_uploadEventsAllowed = m_sameOriginRequest || uploadEvents || !isSimpleCrossOriginAccessRequest(m_method, m_requestHeaders);