1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
|
/*
* Copyright (C) 2008 Apple Inc. All Rights Reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE COMPUTER, INC. OR
* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*
*/
#include "third_party/blink/public/platform/web_cors.h"
#include "base/strings/string_util.h"
#include "base/strings/stringprintf.h"
#include "net/http/http_util.h"
#include "third_party/blink/public/platform/web_security_origin.h"
#include "third_party/blink/public/platform/web_url_response.h"
#include "third_party/blink/renderer/platform/loader/cors/cors.h"
#include "third_party/blink/renderer/platform/loader/fetch/fetch_utils.h"
#include "third_party/blink/renderer/platform/loader/fetch/resource_loader_options.h"
#include "third_party/blink/renderer/platform/loader/fetch/resource_request.h"
#include "third_party/blink/renderer/platform/loader/fetch/resource_response.h"
#include "third_party/blink/renderer/platform/network/http_names.h"
#include "third_party/blink/renderer/platform/weborigin/kurl.h"
#include "third_party/blink/renderer/platform/weborigin/scheme_registry.h"
#include "third_party/blink/renderer/platform/wtf/text/string_builder.h"
#include "third_party/blink/renderer/platform/wtf/text/wtf_string.h"
#include "url/gurl.h"
#include "url/url_util.h"
using network::mojom::CORSError;
namespace blink {
namespace WebCORS {
namespace {
// A parser for the value of the Access-Control-Expose-Headers header.
class HTTPHeaderNameListParser {
STACK_ALLOCATED();
public:
explicit HTTPHeaderNameListParser(const String& value)
: value_(value), pos_(0) {}
// Tries parsing |value_| expecting it to be conforming to the #field-name
// ABNF rule defined in RFC 7230. Returns with the field-name entries stored
// in |output| when successful. Otherwise, returns with |output| kept empty.
//
// |output| must be empty.
void Parse(WebHTTPHeaderSet& output) {
DCHECK(output.empty());
while (true) {
ConsumeSpaces();
size_t token_start = pos_;
ConsumeTokenChars();
size_t token_size = pos_ - token_start;
if (token_size == 0) {
output.clear();
return;
}
const CString& name = value_.Substring(token_start, token_size).Ascii();
output.emplace(name.data(), name.length());
ConsumeSpaces();
if (pos_ == value_.length())
return;
if (value_[pos_] == ',') {
++pos_;
} else {
output.clear();
return;
}
}
}
private:
// Consumes zero or more spaces (SP and HTAB) from value_.
void ConsumeSpaces() {
while (true) {
if (pos_ == value_.length())
return;
UChar c = value_[pos_];
if (c != ' ' && c != '\t')
return;
++pos_;
}
}
// Consumes zero or more tchars from value_.
void ConsumeTokenChars() {
while (true) {
if (pos_ == value_.length())
return;
UChar c = value_[pos_];
if (c > 0x7F || !net::HttpUtil::IsTokenChar(c))
return;
++pos_;
}
}
const String value_;
size_t pos_;
};
} // namespace
base::Optional<CORSError> HandleRedirect(
WebSecurityOrigin& current_security_origin,
WebURLRequest& new_request,
const WebURL redirect_response_url,
const int redirect_response_status_code,
const WebHTTPHeaderMap& redirect_response_header,
network::mojom::FetchCredentialsMode credentials_mode,
ResourceLoaderOptions& options) {
const KURL& last_url = redirect_response_url;
const KURL& new_url = new_request.Url();
WebSecurityOrigin& new_security_origin = current_security_origin;
// TODO(tyoshino): This should be fixed to check not only the last one but
// all redirect responses.
if (!current_security_origin.CanRequest(last_url)) {
base::Optional<CORSError> redirect_error =
CORS::CheckRedirectLocation(new_url);
if (redirect_error)
return redirect_error;
KURL redirect_response_kurl = redirect_response_url;
base::Optional<CORSError> access_error =
CORS::CheckAccess(redirect_response_kurl, redirect_response_status_code,
redirect_response_header.GetHTTPHeaderMap(),
credentials_mode, *current_security_origin.Get());
if (access_error)
return access_error;
scoped_refptr<const SecurityOrigin> last_origin =
SecurityOrigin::Create(last_url);
// Set request's origin to a globally unique identifier as specified in
// the step 10 in https://fetch.spec.whatwg.org/#http-redirect-fetch.
if (!last_origin->CanRequest(new_url)) {
options.security_origin = SecurityOrigin::CreateUnique();
new_security_origin = options.security_origin;
}
}
if (!current_security_origin.CanRequest(new_url)) {
new_request.SetHTTPHeaderField(WebString(HTTPNames::Origin),
new_security_origin.ToString());
options.cors_flag = true;
}
return base::nullopt;
}
WebHTTPHeaderSet ExtractCorsExposedHeaderNamesList(
network::mojom::FetchCredentialsMode credentials_mode,
const WebURLResponse& response) {
// If a response was fetched via a service worker, it will always have
// CorsExposedHeaderNames set from the Access-Control-Expose-Headers header.
// For requests that didn't come from a service worker, just parse the CORS
// header.
if (response.WasFetchedViaServiceWorker()) {
WebHTTPHeaderSet header_set;
for (const auto& header : response.CorsExposedHeaderNames())
header_set.emplace(header.Ascii().data(), header.Ascii().length());
return header_set;
}
WebHTTPHeaderSet header_set;
HTTPHeaderNameListParser parser(response.HttpHeaderField(
WebString(HTTPNames::Access_Control_Expose_Headers)));
parser.Parse(header_set);
if (credentials_mode != network::mojom::FetchCredentialsMode::kInclude &&
header_set.find("*") != header_set.end()) {
header_set.clear();
for (const auto& header :
response.ToResourceResponse().HttpHeaderFields()) {
CString name = header.key.Ascii();
header_set.emplace(name.data(), name.length());
}
}
return header_set;
}
bool IsOnAccessControlResponseHeaderWhitelist(const WebString& name) {
DEFINE_THREAD_SAFE_STATIC_LOCAL(
WebHTTPHeaderSet, allowed_cross_origin_response_headers,
({
"cache-control", "content-language", "content-type", "expires",
"last-modified", "pragma",
}));
return allowed_cross_origin_response_headers.find(name.Ascii().data()) !=
allowed_cross_origin_response_headers.end();
}
// In the spec, https://fetch.spec.whatwg.org/#ref-for-concept-request-mode,
// No-CORS mode is highly discouraged from using it for new features. Only
// legacy usages for backward compatibility are allowed except for well-designed
// usages over the fetch API.
bool IsNoCORSAllowedContext(WebURLRequest::RequestContext context) {
switch (context) {
case WebURLRequest::kRequestContextAudio:
case WebURLRequest::kRequestContextFavicon:
case WebURLRequest::kRequestContextFetch:
case WebURLRequest::kRequestContextImage:
case WebURLRequest::kRequestContextObject:
case WebURLRequest::kRequestContextPlugin:
case WebURLRequest::kRequestContextScript:
case WebURLRequest::kRequestContextSharedWorker:
case WebURLRequest::kRequestContextVideo:
case WebURLRequest::kRequestContextWorker:
return true;
default:
return false;
}
}
} // namespace WebCORS
} // namespace blink
|
