1 | /* |
2 | * Copyright (C) 2010 Apple Inc. All Rights Reserved. |
3 | * |
4 | * Redistribution and use in source and binary forms, with or without |
5 | * modification, are permitted provided that the following conditions |
6 | * are met: |
7 | * 1. Redistributions of source code must retain the above copyright |
8 | * notice, this list of conditions and the following disclaimer. |
9 | * 2. Redistributions in binary form must reproduce the above copyright |
10 | * notice, this list of conditions and the following disclaimer in the |
11 | * documentation and/or other materials provided with the distribution. |
12 | * |
13 | * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY |
14 | * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
15 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR |
16 | * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR |
17 | * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, |
18 | * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, |
19 | * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR |
20 | * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY |
21 | * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
22 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
23 | * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
24 | * |
25 | */ |
26 | |
27 | #pragma once |
28 | |
29 | #include <wtf/HashSet.h> |
30 | #include <wtf/text/StringHash.h> |
31 | #include <wtf/text/WTFString.h> |
32 | |
33 | namespace WebCore { |
34 | |
35 | // FIXME: Make HashSet<String>::contains(StringView) work and use StringViews here. |
36 | using URLSchemesMap = HashSet<String, ASCIICaseInsensitiveHash>; |
37 | |
38 | class SchemeRegistry { |
39 | public: |
40 | WEBCORE_EXPORT static void registerURLSchemeAsLocal(const String&); // Thread safe. |
41 | static void removeURLSchemeRegisteredAsLocal(const String&); // Thread safe. |
42 | |
43 | WEBCORE_EXPORT static bool shouldTreatURLSchemeAsLocal(const String&); // Thread safe. |
44 | WEBCORE_EXPORT static bool isBuiltinScheme(const String&); |
45 | |
46 | // Secure schemes do not trigger mixed content warnings. For example, |
47 | // https and data are secure schemes because they cannot be corrupted by |
48 | // active network attackers. |
49 | WEBCORE_EXPORT static void registerURLSchemeAsSecure(const String&); // Thread safe. |
50 | static bool shouldTreatURLSchemeAsSecure(const String&); // Thread safe. |
51 | |
52 | WEBCORE_EXPORT static void registerURLSchemeAsNoAccess(const String&); // Thread safe. |
53 | static bool shouldTreatURLSchemeAsNoAccess(const String&); // Thread safe. |
54 | |
55 | // Display-isolated schemes can only be displayed (in the sense of |
56 | // SecurityOrigin::canDisplay) by documents from the same scheme. |
57 | WEBCORE_EXPORT static void registerURLSchemeAsDisplayIsolated(const String&); // Thread safe. |
58 | static bool shouldTreatURLSchemeAsDisplayIsolated(const String&); // Thread safe. |
59 | |
60 | WEBCORE_EXPORT static void registerURLSchemeAsEmptyDocument(const String&); |
61 | WEBCORE_EXPORT static bool shouldLoadURLSchemeAsEmptyDocument(const String&); |
62 | |
63 | WEBCORE_EXPORT static void setDomainRelaxationForbiddenForURLScheme(bool forbidden, const String&); |
64 | static bool isDomainRelaxationForbiddenForURLScheme(const String&); |
65 | |
66 | // Such schemes should delegate to SecurityOrigin::canRequest for any URL |
67 | // passed to SecurityOrigin::canDisplay. |
68 | static bool canDisplayOnlyIfCanRequest(const String& scheme); // Thread safe. |
69 | WEBCORE_EXPORT static void registerAsCanDisplayOnlyIfCanRequest(const String& scheme); // Thread safe. |
70 | |
71 | // Schemes against which javascript: URLs should not be allowed to run (stop |
72 | // bookmarklets from running on sensitive pages). |
73 | static void registerURLSchemeAsNotAllowingJavascriptURLs(const String& scheme); |
74 | static bool shouldTreatURLSchemeAsNotAllowingJavascriptURLs(const String& scheme); |
75 | |
76 | // Let some schemes opt-out of Private Browsing's default behavior of prohibiting read/write |
77 | // access to Local Storage and Databases. |
78 | WEBCORE_EXPORT static void registerURLSchemeAsAllowingLocalStorageAccessInPrivateBrowsing(const String& scheme); |
79 | WEBCORE_EXPORT static bool allowsLocalStorageAccessInPrivateBrowsing(const String& scheme); |
80 | WEBCORE_EXPORT static void registerURLSchemeAsAllowingDatabaseAccessInPrivateBrowsing(const String& scheme); |
81 | static bool allowsDatabaseAccessInPrivateBrowsing(const String& scheme); |
82 | |
83 | // Allow non-HTTP schemes to be registered to allow CORS requests. |
84 | WEBCORE_EXPORT static void registerURLSchemeAsCORSEnabled(const String& scheme); |
85 | WEBCORE_EXPORT static bool shouldTreatURLSchemeAsCORSEnabled(const String& scheme); |
86 | |
87 | // Allow resources from some schemes to load on a page, regardless of its |
88 | // Content Security Policy. |
89 | WEBCORE_EXPORT static void registerURLSchemeAsBypassingContentSecurityPolicy(const String& scheme); // Thread safe. |
90 | WEBCORE_EXPORT static void removeURLSchemeRegisteredAsBypassingContentSecurityPolicy(const String& scheme); // Thread safe. |
91 | static bool schemeShouldBypassContentSecurityPolicy(const String& scheme); // Thread safe. |
92 | |
93 | // Schemes whose responses should always be revalidated. |
94 | WEBCORE_EXPORT static void registerURLSchemeAsAlwaysRevalidated(const String&); |
95 | static bool shouldAlwaysRevalidateURLScheme(const String&); |
96 | |
97 | // Schemes whose requests should be partitioned in the cache |
98 | WEBCORE_EXPORT static void registerURLSchemeAsCachePartitioned(const String& scheme); // Thread safe. |
99 | static bool shouldPartitionCacheForURLScheme(const String& scheme); // Thread safe. |
100 | |
101 | // Schemes besides http(s) that service workers are allowed to handle |
102 | WEBCORE_EXPORT static void registerURLSchemeServiceWorkersCanHandle(const String& scheme); // Thread safe. |
103 | WEBCORE_EXPORT static bool canServiceWorkersHandleURLScheme(const String& scheme); // Thread safe. |
104 | static bool isServiceWorkerContainerCustomScheme(const String& scheme); // Thread safe. |
105 | |
106 | static bool isUserExtensionScheme(const String& scheme); |
107 | }; |
108 | |
109 | } // namespace WebCore |
110 | |