1 | /* |
2 | * Copyright (C) 2011 Google, Inc. All rights reserved. |
3 | * Copyright (C) 2016 Apple Inc. All rights reserved. |
4 | * |
5 | * Redistribution and use in source and binary forms, with or without |
6 | * modification, are permitted provided that the following conditions |
7 | * are met: |
8 | * 1. Redistributions of source code must retain the above copyright |
9 | * notice, this list of conditions and the following disclaimer. |
10 | * 2. Redistributions in binary form must reproduce the above copyright |
11 | * notice, this list of conditions and the following disclaimer in the |
12 | * documentation and/or other materials provided with the distribution. |
13 | * |
14 | * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. ``AS IS'' AND ANY |
15 | * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
16 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR |
17 | * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR |
18 | * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, |
19 | * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, |
20 | * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR |
21 | * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY |
22 | * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
23 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
24 | * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
25 | */ |
26 | |
27 | #include "config.h" |
28 | #include "ContentSecurityPolicyMediaListDirective.h" |
29 | |
30 | #include "ContentSecurityPolicy.h" |
31 | #include "ContentSecurityPolicyDirectiveList.h" |
32 | #include "ParsingUtilities.h" |
33 | #include <wtf/text/StringHash.h> |
34 | |
35 | namespace WebCore { |
36 | |
37 | static bool isMediaTypeCharacter(UChar c) |
38 | { |
39 | return !isASCIISpace(c) && c != '/'; |
40 | } |
41 | |
42 | ContentSecurityPolicyMediaListDirective::ContentSecurityPolicyMediaListDirective(const ContentSecurityPolicyDirectiveList& directiveList, const String& name, const String& value) |
43 | : ContentSecurityPolicyDirective(directiveList, name, value) |
44 | { |
45 | parse(value); |
46 | } |
47 | |
48 | bool ContentSecurityPolicyMediaListDirective::allows(const String& type) const |
49 | { |
50 | return m_pluginTypes.contains(type); |
51 | } |
52 | |
53 | void ContentSecurityPolicyMediaListDirective::parse(const String& value) |
54 | { |
55 | auto characters = StringView(value).upconvertedCharacters(); |
56 | const UChar* begin = characters; |
57 | const UChar* position = begin; |
58 | const UChar* end = begin + value.length(); |
59 | |
60 | // 'plugin-types ____;' OR 'plugin-types;' |
61 | if (value.isEmpty()) { |
62 | directiveList().policy().reportInvalidPluginTypes(value); |
63 | return; |
64 | } |
65 | |
66 | while (position < end) { |
67 | // _____ OR _____mime1/mime1 |
68 | // ^ ^ |
69 | skipWhile<UChar, isASCIISpace>(position, end); |
70 | if (position == end) |
71 | return; |
72 | |
73 | // mime1/mime1 mime2/mime2 |
74 | // ^ |
75 | begin = position; |
76 | if (!skipExactly<UChar, isMediaTypeCharacter>(position, end)) { |
77 | skipWhile<UChar, isNotASCIISpace>(position, end); |
78 | directiveList().policy().reportInvalidPluginTypes(String(begin, position - begin)); |
79 | continue; |
80 | } |
81 | skipWhile<UChar, isMediaTypeCharacter>(position, end); |
82 | |
83 | // mime1/mime1 mime2/mime2 |
84 | // ^ |
85 | if (!skipExactly<UChar>(position, end, '/')) { |
86 | skipWhile<UChar, isNotASCIISpace>(position, end); |
87 | directiveList().policy().reportInvalidPluginTypes(String(begin, position - begin)); |
88 | continue; |
89 | } |
90 | |
91 | // mime1/mime1 mime2/mime2 |
92 | // ^ |
93 | if (!skipExactly<UChar, isMediaTypeCharacter>(position, end)) { |
94 | skipWhile<UChar, isNotASCIISpace>(position, end); |
95 | directiveList().policy().reportInvalidPluginTypes(String(begin, position - begin)); |
96 | continue; |
97 | } |
98 | skipWhile<UChar, isMediaTypeCharacter>(position, end); |
99 | |
100 | // mime1/mime1 mime2/mime2 OR mime1/mime1 OR mime1/mime1/error |
101 | // ^ ^ ^ |
102 | if (position < end && isNotASCIISpace(*position)) { |
103 | skipWhile<UChar, isNotASCIISpace>(position, end); |
104 | directiveList().policy().reportInvalidPluginTypes(String(begin, position - begin)); |
105 | continue; |
106 | } |
107 | m_pluginTypes.add(String(begin, position - begin)); |
108 | |
109 | ASSERT(position == end || isASCIISpace(*position)); |
110 | } |
111 | } |
112 | |
113 | } // namespace WebCore |
114 | |