1 /*

     2     Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)

     3 

     4     This library is free software; you can redistribute it and/or

     5     modify it under the terms of the GNU Library General Public

     6     License as published by the Free Software Foundation; either

     7     version 2 of the License, or (at your option) any later version.

     8 

     9     This library is distributed in the hope that it will be useful,

    10     but WITHOUT ANY WARRANTY; without even the implied warranty of

    11     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

    12     Library General Public License for more details.

    13 

    14     You should have received a copy of the GNU Library General Public License

    15     along with this library; see the file COPYING.LIB.  If not, write to

    16     the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,

    17     Boston, MA 02110-1301, USA.

    18 */

    19 

    20 #include "config.h"

    21 #include "qwebsecurityorigin.h"

    22 #include "qwebsecurityorigin_p.h"

    23 #include "qwebdatabase.h"

    24 #include "qwebdatabase_p.h"

    25 

    26 #include "DatabaseTracker.h"

    27 #include "KURL.h"

    28 #include "SchemeRegistry.h"

    29 #include "SecurityOrigin.h"

    30 #include <QStringList>

    31 

    32 using namespace WebCore;

    33 

    34 /*!

    35     \class QWebSecurityOrigin

    36     \since 4.5

    37     \brief The QWebSecurityOrigin class defines a security boundary for web sites.

    38 

    39     \inmodule QtWebKit

    40 

    41     QWebSecurityOrigin provides access to the security domains defined by web sites.

    42     An origin consists of a host name, a scheme, and a port number. Web sites

    43     with the same security origin can access each other's resources for client-side

    44     scripting or databases.

    45 

    46     For example the site \c{http://www.example.com/my/page.html} is allowed to share the same

    47     database as \c{http://www.example.com/my/overview.html}, or access each other's

    48     documents when used in HTML frame sets and JavaScript. At the same time it prevents

    49     \c{http://www.malicious.com/evil.html} from accessing \c{http://www.example.com/}'s resources,

    50     because they are of a different security origin.

    51 

    52     By default local schemes like \c{file://} and \c{qrc://} are concidered to be in the same

    53     security origin, and can access each other's resources. You can add additional local schemes

    54     by using QWebSecurityOrigin::addLocalScheme(), or override the default same-origin behavior

    55     by setting QWebSettings::LocalContentCanAccessFileUrls to \c{false}.

    56 

    57     \note Local resources are by default restricted from accessing remote content, which

    58     means your \c{file://} will not be able to access \c{http://domain.com/foo.html}. You

    59     can relax this restriction by setting QWebSettings::LocalContentCanAccessRemoteUrls to

    60     \c{true}.

    61 

    62     Call QWebFrame::securityOrigin() to get the QWebSecurityOrigin for a frame in a

    63     web page, and use host(), scheme() and port() to identify the security origin.

    64 

    65     Use databases() to access the databases defined within a security origin. The

    66     disk usage of the origin's databases can be limited with setDatabaseQuota().

    67     databaseQuota() and databaseUsage() report the current limit as well as the

    68     current usage.

    69 

    70     For more information refer to the

    71     \l{http://en.wikipedia.org/wiki/Same_origin_policy}{"Same origin policy" Wikipedia Article}.

    72 

    73     \sa QWebFrame::securityOrigin()

    74 */

    75 

    76 /*!

    77     Constructs a security origin from \a other.

    78 */

    79 QWebSecurityOrigin::QWebSecurityOrigin(const QWebSecurityOrigin& other) : d(other.d)

    80 {

    81 }

    82 

    83 /*!

    84     Assigns the \a other security origin to this.

    85 */

    86 QWebSecurityOrigin& QWebSecurityOrigin::operator=(const QWebSecurityOrigin& other)

    87 {

    88     d = other.d;

    89     return *this;

    90 }

    91 

    92 /*!

    93     Returns the scheme defining the security origin.

    94 */

    95 QString QWebSecurityOrigin::scheme() const

    96 {

    97     return d->origin->protocol();

    98 }

    99 

   100 /*!

   101     Returns the host name defining the security origin.

   102 */

   103 QString QWebSecurityOrigin::host() const

   104 {

   105     return d->origin->host();

   106 }

   107 

   108 /*!

   109     Returns the port number defining the security origin.

   110 */

   111 int QWebSecurityOrigin::port() const

   112 {

   113     return d->origin->port();

   114 }

   115 

   116 /*!

   117     Returns the number of bytes all databases in the security origin

   118     use on the disk.

   119 */

   120 qint64 QWebSecurityOrigin::databaseUsage() const

   121 {

   122 #if ENABLE(DATABASE)

   123     return DatabaseTracker::tracker().usageForOrigin(d->origin.get());

   124 #else

   125     return 0;

   126 #endif

   127 }

   128 

   129 /*!

   130     Returns the quota for the databases in the security origin.

   131 */

   132 qint64 QWebSecurityOrigin::databaseQuota() const

   133 {

   134 #if ENABLE(DATABASE)

   135     return DatabaseTracker::tracker().quotaForOrigin(d->origin.get());

   136 #else

   137     return 0;

   138 #endif

   139 }

   140 

   141 /*!

   142     Sets the quota for the databases in the security origin to \a quota bytes.

   143 

   144     If the quota is set to a value less than the current usage, the quota will remain

   145     and no data will be purged to meet the new quota. However, no new data can be added

   146     to databases in this origin.

   147 */

   148 void QWebSecurityOrigin::setDatabaseQuota(qint64 quota)

   149 {

   150 #if ENABLE(DATABASE)

   151     DatabaseTracker::tracker().setQuota(d->origin.get(), quota);

   152 #endif

   153 }

   154 

   155 /*!

   156     Destroys the security origin.

   157 */

   158 QWebSecurityOrigin::~QWebSecurityOrigin()

   159 {

   160 }

   161 

   162 /*!

   163     \internal

   164 */

   165 QWebSecurityOrigin::QWebSecurityOrigin(QWebSecurityOriginPrivate* priv)

   166 {

   167     d = priv;

   168 }

   169 

   170 /*!

   171     Returns a list of all security origins with a database quota defined.

   172 */

   173 QList<QWebSecurityOrigin> QWebSecurityOrigin::allOrigins()

   174 {

   175     QList<QWebSecurityOrigin> webOrigins;

   176 

   177 #if ENABLE(DATABASE)

   178     Vector<RefPtr<SecurityOrigin> > coreOrigins;

   179     DatabaseTracker::tracker().origins(coreOrigins);

   180 

   181     for (unsigned i = 0; i < coreOrigins.size(); ++i) {

   182         QWebSecurityOriginPrivate* priv = new QWebSecurityOriginPrivate(coreOrigins[i].get());

   183         webOrigins.append(priv);

   184     }

   185 #endif

   186 

   187     return webOrigins;

   188 }

   189 

   190 /*!

   191     Returns a list of all databases defined in the security origin.

   192 */

   193 QList<QWebDatabase> QWebSecurityOrigin::databases() const

   194 {

   195     QList<QWebDatabase> databases;

   196 

   197 #if ENABLE(DATABASE)

   198     Vector<String> nameVector;

   199 

   200     if (!DatabaseTracker::tracker().databaseNamesForOrigin(d->origin.get(), nameVector))

   201         return databases;

   202     for (unsigned i = 0; i < nameVector.size(); ++i) {

   203         QWebDatabasePrivate* priv = new QWebDatabasePrivate();

   204         priv->name = nameVector[i];

   205         priv->origin = this->d->origin;

   206         QWebDatabase webDatabase(priv);

   207         databases.append(webDatabase);

   208     }

   209 #endif

   210 

   211     return databases;

   212 }

   213 

   214 /*!

   215     \since 4.6

   216 

   217     Adds the given \a scheme to the list of schemes that are considered equivalent

   218     to the \c file: scheme.

   219 

   220     Cross domain restrictions depend on the two web settings QWebSettings::LocalContentCanAccessFileUrls

   221     and QWebSettings::LocalContentCanAccessFileUrls. By default all local schemes are concidered to be

   222     in the same security origin, and local schemes can not access remote content.

   223 */

   224 void QWebSecurityOrigin::addLocalScheme(const QString& scheme)

   225 {

   226     SchemeRegistry::registerURLSchemeAsLocal(scheme);

   227 }

   228 

   229 /*!

   230     \since 4.6

   231 

   232     Removes the given \a scheme from the list of local schemes.

   233 

   234     \note You can not remove the \c{file://} scheme from the list

   235     of local schemes.

   236 

   237     \sa addLocalScheme()

   238 */

   239 void QWebSecurityOrigin::removeLocalScheme(const QString& scheme)

   240 {

   241     SchemeRegistry::removeURLSchemeRegisteredAsLocal(scheme);

   242 }

   243 

   244 /*!

   245     \since 4.6

   246     Returns a list of all the schemes concidered to be local.

   247 

   248     By default this is \c{file://} and \c{qrc://}.

   249 

   250     \sa addLocalScheme(), removeLocalScheme()

   251 */

   252 QStringList QWebSecurityOrigin::localSchemes()

   253 {

   254     QStringList list;

   255     const URLSchemesMap& map = SchemeRegistry::localURLSchemes();

   256     URLSchemesMap::const_iterator end = map.end();

   257     for (URLSchemesMap::const_iterator i = map.begin(); i != end; ++i) {

   258         const QString scheme = *i;

   259         list.append(scheme);

   260     }

   261     return list;

   262 }