1 /* 2 * Copyright (C) 2006, 2008, 2009, 2010 Apple Inc. All rights reserved. 3 * Copyright (C) 2010, 2011, 2012 Google Inc. All rights reserved. 4 * 5 * This library is free software; you can redistribute it and/or 6 * modify it under the terms of the GNU Library General Public 7 * License as published by the Free Software Foundation; either 8 * version 2 of the License, or (at your option) any later version. 9 * 10 * This library is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 13 * Library General Public License for more details. 14 * 15 * You should have received a copy of the GNU Library General Public License 16 * along with this library; see the file COPYING.LIB. If not, write to 17 * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, 18 * Boston, MA 02110-1301, USA. 19 */ 20 21 #include "config.h" 22 #include "core/html/forms/FormController.h" 23 24 #include "core/html/HTMLFormControlElementWithState.h" 25 #include "core/html/HTMLFormElement.h" 26 #include "core/html/HTMLInputElement.h" 27 #include "platform/FileChooser.h" 28 #include "wtf/Deque.h" 29 #include "wtf/HashTableDeletedValueType.h" 30 #include "wtf/text/StringBuilder.h" 31 32 namespace WebCore { 33 34 using namespace HTMLNames; 35 36 static inline HTMLFormElement* ownerFormForState(const HTMLFormControlElementWithState& control) 37 { 38 // Assume controls with form attribute have no owners because we restore 39 // state during parsing and form owners of such controls might be 40 // indeterminate. 41 return control.fastHasAttribute(formAttr) ? 0 : control.form(); 42 } 43 44 // ---------------------------------------------------------------------------- 45 46 // Serilized form of FormControlState: 47 // (',' means strings around it are separated in stateVector.) 48 // 49 // SerializedControlState ::= SkipState | RestoreState 50 // SkipState ::= '0' 51 // RestoreState ::= UnsignedNumber, ControlValue+ 52 // UnsignedNumber ::= [0-9]+ 53 // ControlValue ::= arbitrary string 54 // 55 // RestoreState has a sequence of ControlValues. The length of the 56 // sequence is represented by UnsignedNumber. 57 58 void FormControlState::serializeTo(Vector<String>& stateVector) const 59 { 60 ASSERT(!isFailure()); 61 stateVector.append(String::number(m_values.size())); 62 for (size_t i = 0; i < m_values.size(); ++i) 63 stateVector.append(m_values[i].isNull() ? emptyString() : m_values[i]); 64 } 65 66 FormControlState FormControlState::deserialize(const Vector<String>& stateVector, size_t& index) 67 { 68 if (index >= stateVector.size()) 69 return FormControlState(TypeFailure); 70 size_t valueSize = stateVector[index++].toUInt(); 71 if (!valueSize) 72 return FormControlState(); 73 if (index + valueSize > stateVector.size()) 74 return FormControlState(TypeFailure); 75 FormControlState state; 76 state.m_values.reserveCapacity(valueSize); 77 for (size_t i = 0; i < valueSize; ++i) 78 state.append(stateVector[index++]); 79 return state; 80 } 81 82 // ---------------------------------------------------------------------------- 83 84 class FormElementKey { 85 public: 86 FormElementKey(StringImpl* = 0, StringImpl* = 0); 87 ~FormElementKey(); 88 FormElementKey(const FormElementKey&); 89 FormElementKey& operator=(const FormElementKey&); 90 91 StringImpl* name() const { return m_name; } 92 StringImpl* type() const { return m_type; } 93 94 // Hash table deleted values, which are only constructed and never copied or destroyed. 95 FormElementKey(WTF::HashTableDeletedValueType) : m_name(hashTableDeletedValue()) { } 96 bool isHashTableDeletedValue() const { return m_name == hashTableDeletedValue(); } 97 98 private: 99 void ref() const; 100 void deref() const; 101 102 static StringImpl* hashTableDeletedValue() { return reinterpret_cast<StringImpl*>(-1); } 103 104 StringImpl* m_name; 105 StringImpl* m_type; 106 }; 107 108 FormElementKey::FormElementKey(StringImpl* name, StringImpl* type) 109 : m_name(name) 110 , m_type(type) 111 { 112 ref(); 113 } 114 115 FormElementKey::~FormElementKey() 116 { 117 deref(); 118 } 119 120 FormElementKey::FormElementKey(const FormElementKey& other) 121 : m_name(other.name()) 122 , m_type(other.type()) 123 { 124 ref(); 125 } 126 127 FormElementKey& FormElementKey::operator=(const FormElementKey& other) 128 { 129 other.ref(); 130 deref(); 131 m_name = other.name(); 132 m_type = other.type(); 133 return *this; 134 } 135 136 void FormElementKey::ref() const 137 { 138 if (name()) 139 name()->ref(); 140 if (type()) 141 type()->ref(); 142 } 143 144 void FormElementKey::deref() const 145 { 146 if (name()) 147 name()->deref(); 148 if (type()) 149 type()->deref(); 150 } 151 152 inline bool operator==(const FormElementKey& a, const FormElementKey& b) 153 { 154 return a.name() == b.name() && a.type() == b.type(); 155 } 156 157 struct FormElementKeyHash { 158 static unsigned hash(const FormElementKey&); 159 static bool equal(const FormElementKey& a, const FormElementKey& b) { return a == b; } 160 static const bool safeToCompareToEmptyOrDeleted = true; 161 }; 162 163 unsigned FormElementKeyHash::hash(const FormElementKey& key) 164 { 165 return StringHasher::hashMemory<sizeof(FormElementKey)>(&key); 166 } 167 168 struct FormElementKeyHashTraits : WTF::GenericHashTraits<FormElementKey> { 169 static void constructDeletedValue(FormElementKey& slot) { new (NotNull, &slot) FormElementKey(WTF::HashTableDeletedValue); } 170 static bool isDeletedValue(const FormElementKey& value) { return value.isHashTableDeletedValue(); } 171 }; 172 173 // ---------------------------------------------------------------------------- 174 175 class SavedFormState { 176 WTF_MAKE_NONCOPYABLE(SavedFormState); 177 WTF_MAKE_FAST_ALLOCATED; 178 179 public: 180 static PassOwnPtr<SavedFormState> create(); 181 static PassOwnPtr<SavedFormState> deserialize(const Vector<String>&, size_t& index); 182 void serializeTo(Vector<String>&) const; 183 bool isEmpty() const { return m_stateForNewFormElements.isEmpty(); } 184 void appendControlState(const AtomicString& name, const AtomicString& type, const FormControlState&); 185 FormControlState takeControlState(const AtomicString& name, const AtomicString& type); 186 187 Vector<String> getReferencedFilePaths() const; 188 189 private: 190 SavedFormState() : m_controlStateCount(0) { } 191 192 typedef HashMap<FormElementKey, Deque<FormControlState>, FormElementKeyHash, FormElementKeyHashTraits> FormElementStateMap; 193 FormElementStateMap m_stateForNewFormElements; 194 size_t m_controlStateCount; 195 }; 196 197 PassOwnPtr<SavedFormState> SavedFormState::create() 198 { 199 return adoptPtr(new SavedFormState); 200 } 201 202 static bool isNotFormControlTypeCharacter(UChar ch) 203 { 204 return ch != '-' && (ch > 'z' || ch < 'a'); 205 } 206 207 PassOwnPtr<SavedFormState> SavedFormState::deserialize(const Vector<String>& stateVector, size_t& index) 208 { 209 if (index >= stateVector.size()) 210 return nullptr; 211 // FIXME: We need String::toSizeT(). 212 size_t itemCount = stateVector[index++].toUInt(); 213 if (!itemCount) 214 return nullptr; 215 OwnPtr<SavedFormState> savedFormState = adoptPtr(new SavedFormState); 216 while (itemCount--) { 217 if (index + 1 >= stateVector.size()) 218 return nullptr; 219 String name = stateVector[index++]; 220 String type = stateVector[index++]; 221 FormControlState state = FormControlState::deserialize(stateVector, index); 222 if (type.isEmpty() || type.find(isNotFormControlTypeCharacter) != kNotFound || state.isFailure()) 223 return nullptr; 224 savedFormState->appendControlState(AtomicString(name), AtomicString(type), state); 225 } 226 return savedFormState.release(); 227 } 228 229 void SavedFormState::serializeTo(Vector<String>& stateVector) const 230 { 231 stateVector.append(String::number(m_controlStateCount)); 232 for (FormElementStateMap::const_iterator it = m_stateForNewFormElements.begin(); it != m_stateForNewFormElements.end(); ++it) { 233 const FormElementKey& key = it->key; 234 const Deque<FormControlState>& queue = it->value; 235 for (Deque<FormControlState>::const_iterator queIterator = queue.begin(); queIterator != queue.end(); ++queIterator) { 236 stateVector.append(key.name()); 237 stateVector.append(key.type()); 238 queIterator->serializeTo(stateVector); 239 } 240 } 241 } 242 243 void SavedFormState::appendControlState(const AtomicString& name, const AtomicString& type, const FormControlState& state) 244 { 245 FormElementKey key(name.impl(), type.impl()); 246 FormElementStateMap::iterator it = m_stateForNewFormElements.find(key); 247 if (it != m_stateForNewFormElements.end()) { 248 it->value.append(state); 249 } else { 250 Deque<FormControlState> stateList; 251 stateList.append(state); 252 m_stateForNewFormElements.set(key, stateList); 253 } 254 m_controlStateCount++; 255 } 256 257 FormControlState SavedFormState::takeControlState(const AtomicString& name, const AtomicString& type) 258 { 259 if (m_stateForNewFormElements.isEmpty()) 260 return FormControlState(); 261 FormElementStateMap::iterator it = m_stateForNewFormElements.find(FormElementKey(name.impl(), type.impl())); 262 if (it == m_stateForNewFormElements.end()) 263 return FormControlState(); 264 ASSERT(it->value.size()); 265 FormControlState state = it->value.takeFirst(); 266 m_controlStateCount--; 267 if (!it->value.size()) 268 m_stateForNewFormElements.remove(it); 269 return state; 270 } 271 272 Vector<String> SavedFormState::getReferencedFilePaths() const 273 { 274 Vector<String> toReturn; 275 for (FormElementStateMap::const_iterator it = m_stateForNewFormElements.begin(); it != m_stateForNewFormElements.end(); ++it) { 276 const FormElementKey& key = it->key; 277 if (!equal(key.type(), "file", 4)) 278 continue; 279 const Deque<FormControlState>& queue = it->value; 280 for (Deque<FormControlState>::const_iterator queIterator = queue.begin(); queIterator != queue.end(); ++queIterator) { 281 const Vector<FileChooserFileInfo>& selectedFiles = HTMLInputElement::filesFromFileInputFormControlState(*queIterator); 282 for (size_t i = 0; i < selectedFiles.size(); ++i) 283 toReturn.append(selectedFiles[i].path); 284 } 285 } 286 return toReturn; 287 } 288 289 // ---------------------------------------------------------------------------- 290 291 class FormKeyGenerator FINAL : public NoBaseWillBeGarbageCollectedFinalized<FormKeyGenerator> { 292 WTF_MAKE_NONCOPYABLE(FormKeyGenerator); 293 WTF_MAKE_FAST_ALLOCATED_WILL_BE_REMOVED; 294 295 public: 296 static PassOwnPtrWillBeRawPtr<FormKeyGenerator> create() { return adoptPtrWillBeNoop(new FormKeyGenerator); } 297 void trace(Visitor* visitor) { visitor->trace(m_formToKeyMap); } 298 const AtomicString& formKey(const HTMLFormControlElementWithState&); 299 void willDeleteForm(HTMLFormElement*); 300 301 private: 302 FormKeyGenerator() { } 303 304 typedef WillBeHeapHashMap<RawPtrWillBeMember<HTMLFormElement>, AtomicString> FormToKeyMap; 305 typedef HashMap<String, unsigned> FormSignatureToNextIndexMap; 306 FormToKeyMap m_formToKeyMap; 307 FormSignatureToNextIndexMap m_formSignatureToNextIndexMap; 308 }; 309 310 static inline void recordFormStructure(const HTMLFormElement& form, StringBuilder& builder) 311 { 312 // 2 is enough to distinguish forms in webkit.org/b/91209#c0 313 const size_t namedControlsToBeRecorded = 2; 314 const FormAssociatedElement::List& controls = form.associatedElements(); 315 builder.append(" ["); 316 for (size_t i = 0, namedControls = 0; i < controls.size() && namedControls < namedControlsToBeRecorded; ++i) { 317 if (!controls[i]->isFormControlElementWithState()) 318 continue; 319 HTMLFormControlElementWithState* control = toHTMLFormControlElementWithState(controls[i]); 320 if (!ownerFormForState(*control)) 321 continue; 322 AtomicString name = control->name(); 323 if (name.isEmpty()) 324 continue; 325 namedControls++; 326 builder.append(name); 327 builder.append(" "); 328 } 329 builder.append("]"); 330 } 331 332 static inline String formSignature(const HTMLFormElement& form) 333 { 334 KURL actionURL = form.getURLAttribute(actionAttr); 335 // Remove the query part because it might contain volatile parameters such 336 // as a session key. 337 if (!actionURL.isEmpty()) 338 actionURL.setQuery(String()); 339 340 StringBuilder builder; 341 if (!actionURL.isEmpty()) 342 builder.append(actionURL.string()); 343 344 recordFormStructure(form, builder); 345 return builder.toString(); 346 } 347 348 const AtomicString& FormKeyGenerator::formKey(const HTMLFormControlElementWithState& control) 349 { 350 HTMLFormElement* form = ownerFormForState(control); 351 if (!form) { 352 DEFINE_STATIC_LOCAL(const AtomicString, formKeyForNoOwner, ("No owner", AtomicString::ConstructFromLiteral)); 353 return formKeyForNoOwner; 354 } 355 FormToKeyMap::const_iterator it = m_formToKeyMap.find(form); 356 if (it != m_formToKeyMap.end()) 357 return it->value; 358 359 String signature = formSignature(*form); 360 ASSERT(!signature.isNull()); 361 FormSignatureToNextIndexMap::AddResult result = m_formSignatureToNextIndexMap.add(signature, 0); 362 unsigned nextIndex = result.storedValue->value++; 363 364 StringBuilder formKeyBuilder; 365 formKeyBuilder.append(signature); 366 formKeyBuilder.appendLiteral(" #"); 367 formKeyBuilder.appendNumber(nextIndex); 368 FormToKeyMap::AddResult addFormKeyresult = m_formToKeyMap.add(form, formKeyBuilder.toAtomicString()); 369 return addFormKeyresult.storedValue->value; 370 } 371 372 void FormKeyGenerator::willDeleteForm(HTMLFormElement* form) 373 { 374 ASSERT(form); 375 m_formToKeyMap.remove(form); 376 } 377 378 // ---------------------------------------------------------------------------- 379 380 PassRefPtrWillBeRawPtr<DocumentState> DocumentState::create() 381 { 382 return adoptRefWillBeNoop(new DocumentState); 383 } 384 385 DEFINE_EMPTY_DESTRUCTOR_WILL_BE_REMOVED(DocumentState) 386 387 void DocumentState::trace(Visitor* visitor) 388 { 389 visitor->trace(m_formControls); 390 } 391 392 void DocumentState::addControl(HTMLFormControlElementWithState* control) 393 { 394 ASSERT(!m_formControls.contains(control)); 395 m_formControls.add(control); 396 } 397 398 void DocumentState::removeControl(HTMLFormControlElementWithState* control) 399 { 400 RELEASE_ASSERT(m_formControls.contains(control)); 401 m_formControls.remove(control); 402 } 403 404 static String formStateSignature() 405 { 406 // In the legacy version of serialized state, the first item was a name 407 // attribute value of a form control. The following string literal should 408 // contain some characters which are rarely used for name attribute values. 409 DEFINE_STATIC_LOCAL(String, signature, ("\n\r?% WebKit serialized form state version 8 \n\r=&")); 410 return signature; 411 } 412 413 Vector<String> DocumentState::toStateVector() 414 { 415 OwnPtrWillBeRawPtr<FormKeyGenerator> keyGenerator = FormKeyGenerator::create(); 416 OwnPtr<SavedFormStateMap> stateMap = adoptPtr(new SavedFormStateMap); 417 for (FormElementListHashSet::const_iterator it = m_formControls.begin(); it != m_formControls.end(); ++it) { 418 HTMLFormControlElementWithState* control = it->get(); 419 ASSERT(control->inDocument()); 420 if (!control->shouldSaveAndRestoreFormControlState()) 421 continue; 422 SavedFormStateMap::AddResult result = stateMap->add(keyGenerator->formKey(*control), nullptr); 423 if (result.isNewEntry) 424 result.storedValue->value = SavedFormState::create(); 425 result.storedValue->value->appendControlState(control->name(), control->type(), control->saveFormControlState()); 426 } 427 428 Vector<String> stateVector; 429 stateVector.reserveInitialCapacity(m_formControls.size() * 4); 430 stateVector.append(formStateSignature()); 431 for (SavedFormStateMap::const_iterator it = stateMap->begin(); it != stateMap->end(); ++it) { 432 stateVector.append(it->key); 433 it->value->serializeTo(stateVector); 434 } 435 bool hasOnlySignature = stateVector.size() == 1; 436 if (hasOnlySignature) 437 stateVector.clear(); 438 return stateVector; 439 } 440 441 // ---------------------------------------------------------------------------- 442 443 FormController::FormController() 444 : m_documentState(DocumentState::create()) 445 { 446 } 447 448 FormController::~FormController() 449 { 450 } 451 452 void FormController::trace(Visitor* visitor) 453 { 454 visitor->trace(m_radioButtonGroupScope); 455 visitor->trace(m_documentState); 456 visitor->trace(m_formKeyGenerator); 457 } 458 459 DocumentState* FormController::formElementsState() const 460 { 461 return m_documentState.get(); 462 } 463 464 void FormController::setStateForNewFormElements(const Vector<String>& stateVector) 465 { 466 formStatesFromStateVector(stateVector, m_savedFormStateMap); 467 } 468 469 FormControlState FormController::takeStateForFormElement(const HTMLFormControlElementWithState& control) 470 { 471 if (m_savedFormStateMap.isEmpty()) 472 return FormControlState(); 473 if (!m_formKeyGenerator) 474 m_formKeyGenerator = FormKeyGenerator::create(); 475 SavedFormStateMap::iterator it = m_savedFormStateMap.find(m_formKeyGenerator->formKey(control)); 476 if (it == m_savedFormStateMap.end()) 477 return FormControlState(); 478 FormControlState state = it->value->takeControlState(control.name(), control.type()); 479 if (it->value->isEmpty()) 480 m_savedFormStateMap.remove(it); 481 return state; 482 } 483 484 void FormController::formStatesFromStateVector(const Vector<String>& stateVector, SavedFormStateMap& map) 485 { 486 map.clear(); 487 488 size_t i = 0; 489 if (stateVector.size() < 1 || stateVector[i++] != formStateSignature()) 490 return; 491 492 while (i + 1 < stateVector.size()) { 493 AtomicString formKey = AtomicString(stateVector[i++]); 494 OwnPtr<SavedFormState> state = SavedFormState::deserialize(stateVector, i); 495 if (!state) { 496 i = 0; 497 break; 498 } 499 map.add(formKey, state.release()); 500 } 501 if (i != stateVector.size()) 502 map.clear(); 503 } 504 505 void FormController::willDeleteForm(HTMLFormElement* form) 506 { 507 if (m_formKeyGenerator) 508 m_formKeyGenerator->willDeleteForm(form); 509 } 510 511 void FormController::restoreControlStateFor(HTMLFormControlElementWithState& control) 512 { 513 // We don't save state of a control with shouldSaveAndRestoreFormControlState() 514 // == false. But we need to skip restoring process too because a control in 515 // another form might have the same pair of name and type and saved its state. 516 if (!control.shouldSaveAndRestoreFormControlState()) 517 return; 518 if (ownerFormForState(control)) 519 return; 520 FormControlState state = takeStateForFormElement(control); 521 if (state.valueSize() > 0) 522 control.restoreFormControlState(state); 523 } 524 525 void FormController::restoreControlStateIn(HTMLFormElement& form) 526 { 527 const FormAssociatedElement::List& elements = form.associatedElements(); 528 for (size_t i = 0; i < elements.size(); ++i) { 529 if (!elements[i]->isFormControlElementWithState()) 530 continue; 531 HTMLFormControlElementWithState* control = toHTMLFormControlElementWithState(elements[i]); 532 if (!control->shouldSaveAndRestoreFormControlState()) 533 continue; 534 if (ownerFormForState(*control) != &form) 535 continue; 536 FormControlState state = takeStateForFormElement(*control); 537 if (state.valueSize() > 0) 538 control->restoreFormControlState(state); 539 } 540 } 541 542 Vector<String> FormController::getReferencedFilePaths(const Vector<String>& stateVector) 543 { 544 Vector<String> toReturn; 545 SavedFormStateMap map; 546 formStatesFromStateVector(stateVector, map); 547 for (SavedFormStateMap::const_iterator it = map.begin(); it != map.end(); ++it) 548 toReturn.appendVector(it->value->getReferencedFilePaths()); 549 return toReturn; 550 } 551 552 void FormController::registerStatefulFormControl(HTMLFormControlElementWithState& control) 553 { 554 m_documentState->addControl(&control); 555 } 556 557 void FormController::unregisterStatefulFormControl(HTMLFormControlElementWithState& control) 558 { 559 m_documentState->removeControl(&control); 560 } 561 562 } // namespace WebCore 563