Home | History | Annotate | Download | only in dom 
      1 /*
      2  * Copyright (C) 2013 Google Inc. All Rights Reserved.
      3  *
      4  * Redistribution and use in source and binary forms, with or without
      5  * modification, are permitted provided that the following conditions
      6  * are met:
      7  * 1. Redistributions of source code must retain the above copyright
      8  *    notice, this list of conditions and the following disclaimer.
      9  * 2. Redistributions in binary form must reproduce the above copyright
     10  *    notice, this list of conditions and the following disclaimer in the
     11  *    documentation and/or other materials provided with the distribution.
     12  *
     13  * THIS SOFTWARE IS PROVIDED BY GOOGLE, INC. ``AS IS'' AND ANY
     14  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     15  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
     16  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
     17  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
     18  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
     19  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
     20  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
     21  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
     23  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     24  *
     25  */
     26 
     27 #include "config.h"
     28 #include "core/dom/SandboxFlags.h"
     29 
     30 #include "core/html/parser/HTMLParserIdioms.h"
     31 #include "wtf/text/StringBuilder.h"
     32 
     33 namespace WebCore {
     34 
     35 SandboxFlags parseSandboxPolicy(const String& policy, String& invalidTokensErrorMessage)
     36 {
     37     // http://www.w3.org/TR/html5/the-iframe-element.html#attr-iframe-sandbox
     38     // Parse the unordered set of unique space-separated tokens.
     39     SandboxFlags flags = SandboxAll;
     40     unsigned length = policy.length();
     41     unsigned start = 0;
     42     unsigned numberOfTokenErrors = 0;
     43     StringBuilder tokenErrors;
     44     while (true) {
     45         while (start < length && isHTMLSpace<UChar>(policy[start]))
     46             ++start;
     47         if (start >= length)
     48             break;
     49         unsigned end = start + 1;
     50         while (end < length && !isHTMLSpace<UChar>(policy[end]))
     51             ++end;
     52 
     53         // Turn off the corresponding sandbox flag if it's set as "allowed".
     54         String sandboxToken = policy.substring(start, end - start);
     55         if (equalIgnoringCase(sandboxToken, "allow-same-origin")) {
     56             flags &= ~SandboxOrigin;
     57         } else if (equalIgnoringCase(sandboxToken, "allow-forms")) {
     58             flags &= ~SandboxForms;
     59         } else if (equalIgnoringCase(sandboxToken, "allow-scripts")) {
     60             flags &= ~SandboxScripts;
     61             flags &= ~SandboxAutomaticFeatures;
     62         } else if (equalIgnoringCase(sandboxToken, "allow-top-navigation")) {
     63             flags &= ~SandboxTopNavigation;
     64         } else if (equalIgnoringCase(sandboxToken, "allow-popups")) {
     65             flags &= ~SandboxPopups;
     66         } else if (equalIgnoringCase(sandboxToken, "allow-pointer-lock")) {
     67             flags &= ~SandboxPointerLock;
     68         } else {
     69             if (numberOfTokenErrors)
     70                 tokenErrors.appendLiteral(", '");
     71             else
     72                 tokenErrors.append('\'');
     73             tokenErrors.append(sandboxToken);
     74             tokenErrors.append('\'');
     75             numberOfTokenErrors++;
     76         }
     77 
     78         start = end + 1;
     79     }
     80 
     81     if (numberOfTokenErrors) {
     82         if (numberOfTokenErrors > 1)
     83             tokenErrors.appendLiteral(" are invalid sandbox flags.");
     84         else
     85             tokenErrors.appendLiteral(" is an invalid sandbox flag.");
     86         invalidTokensErrorMessage = tokenErrors.toString();
     87     }
     88 
     89     return flags;
     90 }
     91 
     92 }
     93