mirror of
https://github.com/zebrajr/ladybird.git
synced 2025-12-06 12:20:00 +01:00
dc401f49ea
While Origin is defined in the HTML spec - this leaves us with quite an awkward relationship as the URL spec makes use of AO's from what is defined in the HTML spec. To simplify this factoring, relocate Origin into LibURL.
86 lines
3.7 KiB
C++
86 lines
3.7 KiB
C++
/*
|
||
* Copyright (c) 2022-2023, Linus Groh <linusg@serenityos.org>
|
||
*
|
||
* SPDX-License-Identifier: BSD-2-Clause
|
||
*/
|
||
|
||
#include <LibWeb/DOMURL/DOMURL.h>
|
||
#include <LibWeb/Fetch/Fetching/Checks.h>
|
||
#include <LibWeb/Fetch/Infrastructure/HTTP/Requests.h>
|
||
#include <LibWeb/Fetch/Infrastructure/HTTP/Responses.h>
|
||
|
||
namespace Web::Fetch::Fetching {
|
||
|
||
// https://fetch.spec.whatwg.org/#concept-cors-check
|
||
bool cors_check(Infrastructure::Request const& request, Infrastructure::Response const& response)
|
||
{
|
||
// 1. Let origin be the result of getting `Access-Control-Allow-Origin` from response’s header list.
|
||
auto origin = response.header_list()->get("Access-Control-Allow-Origin"sv.bytes());
|
||
|
||
// 2. If origin is null, then return failure.
|
||
// NOTE: Null is not `null`.
|
||
if (!origin.has_value())
|
||
return false;
|
||
|
||
// 3. If request’s credentials mode is not "include" and origin is `*`, then return success.
|
||
if (request.credentials_mode() != Infrastructure::Request::CredentialsMode::Include && origin->span() == "*"sv.bytes())
|
||
return true;
|
||
|
||
// 4. If the result of byte-serializing a request origin with request is not origin, then return failure.
|
||
if (request.byte_serialize_origin() != *origin)
|
||
return false;
|
||
|
||
// 5. If request’s credentials mode is not "include", then return success.
|
||
if (request.credentials_mode() != Infrastructure::Request::CredentialsMode::Include)
|
||
return true;
|
||
|
||
// 6. Let credentials be the result of getting `Access-Control-Allow-Credentials` from response’s header list.
|
||
auto credentials = response.header_list()->get("Access-Control-Allow-Credentials"sv.bytes());
|
||
|
||
// 7. If credentials is `true`, then return success.
|
||
if (credentials.has_value() && credentials->span() == "true"sv.bytes())
|
||
return true;
|
||
|
||
// 8. Return failure.
|
||
return false;
|
||
}
|
||
|
||
// https://fetch.spec.whatwg.org/#concept-tao-check
|
||
bool tao_check(Infrastructure::Request const& request, Infrastructure::Response const& response)
|
||
{
|
||
// 1. If request’s timing allow failed flag is set, then return failure.
|
||
if (request.timing_allow_failed())
|
||
return false;
|
||
|
||
// 2. Let values be the result of getting, decoding, and splitting `Timing-Allow-Origin` from response’s header list.
|
||
auto values = response.header_list()->get_decode_and_split("Timing-Allow-Origin"sv.bytes());
|
||
|
||
// 3. If values contains "*", then return success.
|
||
if (values.has_value() && values->contains_slow("*"sv))
|
||
return true;
|
||
|
||
// 4. If values contains the result of serializing a request origin with request, then return success.
|
||
if (values.has_value() && values->contains_slow(request.serialize_origin()))
|
||
return true;
|
||
|
||
// 5. If request’s mode is "navigate" and request’s current URL’s origin is not same origin with request’s origin, then return failure.
|
||
// NOTE: This is necessary for navigations of a nested browsing context. There, request’s origin would be the
|
||
// container document’s origin and the TAO check would return failure. Since navigation timing never
|
||
// validates the results of the TAO check, the nested document would still have access to the full timing
|
||
// information, but the container document would not.
|
||
if (request.mode() == Infrastructure::Request::Mode::Navigate
|
||
&& request.origin().has<URL::Origin>()
|
||
&& !DOMURL::url_origin(request.current_url()).is_same_origin(request.origin().get<URL::Origin>())) {
|
||
return false;
|
||
}
|
||
|
||
// 6. If request’s response tainting is "basic", then return success.
|
||
if (request.response_tainting() == Infrastructure::Request::ResponseTainting::Basic)
|
||
return true;
|
||
|
||
// 7. Return failure.
|
||
return false;
|
||
}
|
||
|
||
}
|