Home | History | Annotate | Download | only in storage 
      1 /*
      2  * Copyright (C) 2007 Apple Inc. All rights reserved.
      3  *
      4  * Redistribution and use in source and binary forms, with or without
      5  * modification, are permitted provided that the following conditions
      6  * are met:
      7  *
      8  * 1.  Redistributions of source code must retain the above copyright
      9  *     notice, this list of conditions and the following disclaimer.
     10  * 2.  Redistributions in binary form must reproduce the above copyright
     11  *     notice, this list of conditions and the following disclaimer in the
     12  *     documentation and/or other materials provided with the distribution.
     13  * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
     14  *     its contributors may be used to endorse or promote products derived
     15  *     from this software without specific prior written permission.
     16  *
     17  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
     18  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
     19  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
     20  * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
     21  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
     22  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
     23  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
     24  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     25  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     26  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     27  */
     28 #ifndef DatabaseAuthorizer_h
     29 #define DatabaseAuthorizer_h
     30 
     31 #include "StringHash.h"
     32 #include <wtf/HashSet.h>
     33 #include <wtf/PassRefPtr.h>
     34 #include <wtf/Threading.h>
     35 
     36 namespace WebCore {
     37 
     38 class String;
     39 
     40 extern const int SQLAuthAllow;
     41 extern const int SQLAuthIgnore;
     42 extern const int SQLAuthDeny;
     43 
     44 class DatabaseAuthorizer : public ThreadSafeShared<DatabaseAuthorizer> {
     45 public:
     46     static PassRefPtr<DatabaseAuthorizer> create() { return adoptRef(new DatabaseAuthorizer); }
     47 
     48     int createTable(const String& tableName);
     49     int createTempTable(const String& tableName);
     50     int dropTable(const String& tableName);
     51     int dropTempTable(const String& tableName);
     52     int allowAlterTable(const String& databaseName, const String& tableName);
     53 
     54     int createIndex(const String& indexName, const String& tableName);
     55     int createTempIndex(const String& indexName, const String& tableName);
     56     int dropIndex(const String& indexName, const String& tableName);
     57     int dropTempIndex(const String& indexName, const String& tableName);
     58 
     59     int createTrigger(const String& triggerName, const String& tableName);
     60     int createTempTrigger(const String& triggerName, const String& tableName);
     61     int dropTrigger(const String& triggerName, const String& tableName);
     62     int dropTempTrigger(const String& triggerName, const String& tableName);
     63 
     64     int createView(const String& viewName);
     65     int createTempView(const String& viewName);
     66     int dropView(const String& viewName);
     67     int dropTempView(const String& viewName);
     68 
     69     int createVTable(const String& tableName, const String& moduleName);
     70     int dropVTable(const String& tableName, const String& moduleName);
     71 
     72     int allowDelete(const String& tableName);
     73     int allowInsert(const String& tableName);
     74     int allowUpdate(const String& tableName, const String& columnName);
     75     int allowTransaction();
     76 
     77     int allowSelect() { return SQLAuthAllow; }
     78     int allowRead(const String& tableName, const String& columnName);
     79 
     80     int allowReindex(const String& indexName);
     81     int allowAnalyze(const String& tableName);
     82     int allowFunction(const String& functionName);
     83     int allowPragma(const String& pragmaName, const String& firstArgument);
     84 
     85     int allowAttach(const String& filename);
     86     int allowDetach(const String& databaseName);
     87 
     88     void disable();
     89     void enable();
     90     void setReadOnly();
     91 
     92     void reset();
     93 
     94     bool lastActionWasInsert() const { return m_lastActionWasInsert; }
     95     bool lastActionChangedDatabase() const { return m_lastActionChangedDatabase; }
     96 
     97 private:
     98     DatabaseAuthorizer();
     99     void addWhitelistedFunctions();
    100     int denyBasedOnTableName(const String&);
    101 
    102     bool m_securityEnabled : 1;
    103     bool m_lastActionWasInsert : 1;
    104     bool m_lastActionChangedDatabase : 1;
    105     bool m_readOnly : 1;
    106 
    107     HashSet<String, CaseFoldingHash> m_whitelistedFunctions;
    108 };
    109 
    110 } // namespace WebCore
    111 
    112 #endif // DatabaseAuthorizer_h
    113