1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
|
// Copyright 2018 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#ifndef THIRD_PARTY_BLINK_RENDERER_PLATFORM_LOADER_CORS_CORS_H_
#define THIRD_PARTY_BLINK_RENDERER_PLATFORM_LOADER_CORS_CORS_H_
#include "base/optional.h"
#include "services/network/public/cpp/cors/cors_error_status.h"
#include "services/network/public/mojom/cors.mojom-shared.h"
#include "services/network/public/mojom/fetch_api.mojom-shared.h"
#include "third_party/blink/renderer/platform/platform_export.h"
#include "third_party/blink/renderer/platform/wtf/text/wtf_string.h"
#include "third_party/blink/renderer/platform/wtf/vector.h"
namespace blink {
class HTTPHeaderMap;
class KURL;
class SecurityOrigin;
enum class CORSFlag : uint8_t {
Unset,
Set,
};
// CORS related utility functions.
namespace CORS {
// Thin wrapper functions below are for calling ::network::cors functions from
// Blink core. Once Out-of-renderer CORS is enabled, following functions will
// be removed.
PLATFORM_EXPORT base::Optional<network::CORSErrorStatus> CheckAccess(
const KURL&,
const int response_status_code,
const HTTPHeaderMap&,
network::mojom::FetchCredentialsMode,
const SecurityOrigin&);
PLATFORM_EXPORT base::Optional<network::CORSErrorStatus> CheckPreflightAccess(
const KURL&,
const int response_status_code,
const HTTPHeaderMap&,
network::mojom::FetchCredentialsMode,
const SecurityOrigin&);
PLATFORM_EXPORT base::Optional<network::CORSErrorStatus> CheckRedirectLocation(
const KURL&,
network::mojom::FetchRequestMode,
const SecurityOrigin*,
CORSFlag);
PLATFORM_EXPORT base::Optional<network::mojom::CORSError> CheckPreflight(
const int preflight_response_status_code);
PLATFORM_EXPORT base::Optional<network::CORSErrorStatus> CheckExternalPreflight(
const HTTPHeaderMap&);
PLATFORM_EXPORT bool IsCORSEnabledRequestMode(network::mojom::FetchRequestMode);
PLATFORM_EXPORT base::Optional<network::CORSErrorStatus>
EnsurePreflightResultAndCacheOnSuccess(
const HTTPHeaderMap& response_header_map,
const String& origin,
const KURL& request_url,
const String& request_method,
const HTTPHeaderMap& request_header_map,
network::mojom::FetchCredentialsMode request_credentials_mode);
PLATFORM_EXPORT bool CheckIfRequestCanSkipPreflight(
const String& origin,
const KURL&,
network::mojom::FetchCredentialsMode,
const String& method,
const HTTPHeaderMap& request_header_map);
PLATFORM_EXPORT network::mojom::FetchResponseType CalculateResponseTainting(
const KURL& url,
network::mojom::FetchRequestMode request_mode,
const SecurityOrigin* origin,
CORSFlag cors_flag);
PLATFORM_EXPORT bool CalculateCredentialsFlag(
network::mojom::FetchCredentialsMode credentials_mode,
network::mojom::FetchResponseType response_tainting);
// Thin wrapper functions that will not be removed even after out-of-renderer
// CORS is enabled.
PLATFORM_EXPORT bool IsCORSSafelistedMethod(const String& method);
PLATFORM_EXPORT bool IsCORSSafelistedContentType(const String&);
PLATFORM_EXPORT bool IsCORSSafelistedHeader(const String& name,
const String& value);
PLATFORM_EXPORT bool IsNoCORSSafelistedHeader(const String& name,
const String& value);
PLATFORM_EXPORT Vector<String> CORSUnsafeRequestHeaderNames(
const HTTPHeaderMap& headers);
PLATFORM_EXPORT bool IsForbiddenHeaderName(const String& name);
PLATFORM_EXPORT bool ContainsOnlyCORSSafelistedHeaders(const HTTPHeaderMap&);
PLATFORM_EXPORT bool ContainsOnlyCORSSafelistedOrForbiddenHeaders(
const HTTPHeaderMap&);
PLATFORM_EXPORT bool IsOkStatus(int status);
// Calculates and returns the CORS flag used in several "fetch" algorithms in
// https://fetch.spec.whatwg.org/. This function is corresponding to the CORS
// flag setting logic in https://fetch.spec.whatwg.org/#main-fetch.
// This function can return true even when |request_mode| is |kSameOrigin|.
// |origin| must not be nullptr when |request_mode| is neither |kNoCORS| nor
// |kNavigate|.
// This should be identical to CalculateCORSFlag defined in
// //services/network/cors/cors_url_loader.cc.
// This function will be removed when out-of-renderer CORS is enabled.
PLATFORM_EXPORT bool CalculateCORSFlag(
const KURL& url,
const SecurityOrigin* origin,
network::mojom::FetchRequestMode request_mode);
} // namespace CORS
} // namespace blink
#endif // THIRD_PARTY_BLINK_RENDERER_PLATFORM_LOADER_CORS_CORS_H_
|
