Stowage/ladybird
2
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-11-03 23:00:58 +00:00
Code Issues Projects Releases Packages Wiki Activity
ladybird/Libraries/LibWeb/HTML/PolicyContainers.cpp

106 lines
4 KiB
C++
Raw Normal View History

LibWeb: Add facilities to serialize EnvironmentSettingsObjects This will be used to transfer information about the parent context to DedicatedWorkers and future out-of-process Worker/Worklet implementations for fetching purposes. In order to properly check same-origin and other policies, we need to know more about the outside settings than we were previously passing to the WebWorker process.
2024-03-05 09:29:14 -07:00
/*
* Copyright (c) 2024, Andrew Kaster <akaster@serenityos.org>
LibWeb: Make PolicyContainer GC allocated This is required to store Content Security Policies, as their Directives are implemented as subclasses with overridden virtual functions. Thus, they cannot be stored as generic Directive classes, as it'll lose the ability to call overridden functions when they are copied.
2024-11-25 14:30:12 +00:00
* Copyright (c) 2025, Luke Wilde <luke@ladybird.org>
LibWeb: Add facilities to serialize EnvironmentSettingsObjects This will be used to transfer information about the parent context to DedicatedWorkers and future out-of-process Worker/Worklet implementations for fetching purposes. In order to properly check same-origin and other policies, we need to know more about the outside settings than we were previously passing to the WebWorker process.
2024-03-05 09:29:14 -07:00
*
* SPDX-License-Identifier: BSD-2-Clause
*/
LibWeb: Make PolicyContainer GC allocated This is required to store Content Security Policies, as their Directives are implemented as subclasses with overridden virtual functions. Thus, they cannot be stored as generic Directive classes, as it'll lose the ability to call overridden functions when they are copied.
2024-11-25 14:30:12 +00:00
#include <LibJS/Runtime/Realm.h>
#include <LibURL/URL.h>
LibWeb: Introduce Content Security Policy policies and directives These form the basis of Content Security Policy. A policy is a collection of directives that are parsed from either the Content-Security-Policy(-Report-Only) HTTP header, or the `<meta>` element. The directives are what restrict the operations can be performed in the current global execution context. For example, "frame-ancestors: none" tells us to prevent the page from being loaded in an embedded context, such as `<iframe>`. You can see it a bit like OpenBSD's pledge() functionality, but for the web platform: https://man.openbsd.org/pledge.2
2024-11-25 16:17:17 +00:00
#include <LibWeb/ContentSecurityPolicy/Policy.h>
#include <LibWeb/ContentSecurityPolicy/PolicyList.h>
LibWeb: Create policy containers from responses and then run CSP init This allows us to parse the Content-Security-Policy header and Referrer-Policy header from navigation responses and actually allow them to start having an effect.
2024-11-25 17:01:26 +00:00
#include <LibWeb/Fetch/Infrastructure/HTTP/Responses.h>
LibWeb: Make PolicyContainer GC allocated This is required to store Content Security Policies, as their Directives are implemented as subclasses with overridden virtual functions. Thus, they cannot be stored as generic Directive classes, as it'll lose the ability to call overridden functions when they are copied.
2024-11-25 14:30:12 +00:00
#include <LibWeb/Fetch/Infrastructure/URL.h>
LibWeb: Add facilities to serialize EnvironmentSettingsObjects This will be used to transfer information about the parent context to DedicatedWorkers and future out-of-process Worker/Worklet implementations for fetching purposes. In order to properly check same-origin and other policies, we need to know more about the outside settings than we were previously passing to the WebWorker process.
2024-03-05 09:29:14 -07:00
#include <LibWeb/HTML/PolicyContainers.h>
LibWeb: Make PolicyContainer GC allocated This is required to store Content Security Policies, as their Directives are implemented as subclasses with overridden virtual functions. Thus, they cannot be stored as generic Directive classes, as it'll lose the ability to call overridden functions when they are copied.
2024-11-25 14:30:12 +00:00
#include <LibWeb/HTML/SerializedPolicyContainer.h>
LibWeb: Add facilities to serialize EnvironmentSettingsObjects This will be used to transfer information about the parent context to DedicatedWorkers and future out-of-process Worker/Worklet implementations for fetching purposes. In order to properly check same-origin and other policies, we need to know more about the outside settings than we were previously passing to the WebWorker process.
2024-03-05 09:29:14 -07:00
LibWeb: Make PolicyContainer GC allocated This is required to store Content Security Policies, as their Directives are implemented as subclasses with overridden virtual functions. Thus, they cannot be stored as generic Directive classes, as it'll lose the ability to call overridden functions when they are copied.
2024-11-25 14:30:12 +00:00
namespace Web::HTML {
LibWeb: Add facilities to serialize EnvironmentSettingsObjects This will be used to transfer information about the parent context to DedicatedWorkers and future out-of-process Worker/Worklet implementations for fetching purposes. In order to properly check same-origin and other policies, we need to know more about the outside settings than we were previously passing to the WebWorker process.
2024-03-05 09:29:14 -07:00
LibWeb: Make PolicyContainer GC allocated This is required to store Content Security Policies, as their Directives are implemented as subclasses with overridden virtual functions. Thus, they cannot be stored as generic Directive classes, as it'll lose the ability to call overridden functions when they are copied.
2024-11-25 14:30:12 +00:00
GC_DEFINE_ALLOCATOR(PolicyContainer);
LibWeb: Introduce Content Security Policy policies and directives These form the basis of Content Security Policy. A policy is a collection of directives that are parsed from either the Content-Security-Policy(-Report-Only) HTTP header, or the `<meta>` element. The directives are what restrict the operations can be performed in the current global execution context. For example, "frame-ancestors: none" tells us to prevent the page from being loaded in an embedded context, such as `<iframe>`. You can see it a bit like OpenBSD's pledge() functionality, but for the web platform: https://man.openbsd.org/pledge.2
2024-11-25 16:17:17 +00:00
PolicyContainer::PolicyContainer(JS::Realm& realm)
: csp_list(realm.create<ContentSecurityPolicy::PolicyList>())
LibWeb: Make PolicyContainer GC allocated This is required to store Content Security Policies, as their Directives are implemented as subclasses with overridden virtual functions. Thus, they cannot be stored as generic Directive classes, as it'll lose the ability to call overridden functions when they are copied.
2024-11-25 14:30:12 +00:00
{
}
// https://html.spec.whatwg.org/multipage/browsers.html#requires-storing-the-policy-container-in-history
bool url_requires_storing_the_policy_container_in_history(URL::URL const& url)
LibWeb: Add facilities to serialize EnvironmentSettingsObjects This will be used to transfer information about the parent context to DedicatedWorkers and future out-of-process Worker/Worklet implementations for fetching purposes. In order to properly check same-origin and other policies, we need to know more about the outside settings than we were previously passing to the WebWorker process.
2024-03-05 09:29:14 -07:00
{
LibWeb: Make PolicyContainer GC allocated This is required to store Content Security Policies, as their Directives are implemented as subclasses with overridden virtual functions. Thus, they cannot be stored as generic Directive classes, as it'll lose the ability to call overridden functions when they are copied.
2024-11-25 14:30:12 +00:00
// 1. If url's scheme is "blob", then return false.
if (url.scheme() == "blob"sv)
return false;
LibWeb: Add facilities to serialize EnvironmentSettingsObjects This will be used to transfer information about the parent context to DedicatedWorkers and future out-of-process Worker/Worklet implementations for fetching purposes. In order to properly check same-origin and other policies, we need to know more about the outside settings than we were previously passing to the WebWorker process.
2024-03-05 09:29:14 -07:00
LibWeb: Make PolicyContainer GC allocated This is required to store Content Security Policies, as their Directives are implemented as subclasses with overridden virtual functions. Thus, they cannot be stored as generic Directive classes, as it'll lose the ability to call overridden functions when they are copied.
2024-11-25 14:30:12 +00:00
// 2. If url is local, then return true.
// 3. Return false.
return Fetch::Infrastructure::is_local_url(url);
}
LibWeb: Create policy containers from responses and then run CSP init This allows us to parse the Content-Security-Policy header and Referrer-Policy header from navigation responses and actually allow them to start having an effect.
2024-11-25 17:01:26 +00:00
// https://html.spec.whatwg.org/multipage/browsers.html#creating-a-policy-container-from-a-fetch-response
GC::Ref<PolicyContainer> create_a_policy_container_from_a_fetch_response(JS::Realm& realm, GC::Ref<Fetch::Infrastructure::Response const> response, GC::Ptr<Environment>)
{
// FIXME: 1. If response's URL's scheme is "blob", then return a clone of response's URL's blob URL entry's
// environment's policy container.
// 2. Let result be a new policy container.
GC::Ref<PolicyContainer> result = realm.create<PolicyContainer>(realm);
// 3. Set result's CSP list to the result of parsing a response's Content Security Policies given response.
result->csp_list = ContentSecurityPolicy::Policy::parse_a_responses_content_security_policies(realm, response);
// FIXME: 4. If environment is non-null, then set result's embedder policy to the result of obtaining an embedder
// policy given response and environment. Otherwise, set it to "unsafe-none".
// FIXME: 5. Set result's referrer policy to the result of parsing the `Referrer-Policy` header given response.
// [REFERRERPOLICY]
// Doing this currently makes Fetch fail the policy != ReferrerPolicy::EmptyString verification.
// 6. Return result.
return result;
}
LibWeb: Make PolicyContainer GC allocated This is required to store Content Security Policies, as their Directives are implemented as subclasses with overridden virtual functions. Thus, they cannot be stored as generic Directive classes, as it'll lose the ability to call overridden functions when they are copied.
2024-11-25 14:30:12 +00:00
GC::Ref<PolicyContainer> create_a_policy_container_from_serialized_policy_container(JS::Realm& realm, SerializedPolicyContainer const& serialized_policy_container)
{
GC::Ref<PolicyContainer> result = realm.create<PolicyContainer>(realm);
LibWeb: Introduce Content Security Policy policies and directives These form the basis of Content Security Policy. A policy is a collection of directives that are parsed from either the Content-Security-Policy(-Report-Only) HTTP header, or the `<meta>` element. The directives are what restrict the operations can be performed in the current global execution context. For example, "frame-ancestors: none" tells us to prevent the page from being loaded in an embedded context, such as `<iframe>`. You can see it a bit like OpenBSD's pledge() functionality, but for the web platform: https://man.openbsd.org/pledge.2
2024-11-25 16:17:17 +00:00
result->csp_list = ContentSecurityPolicy::PolicyList::create(realm, serialized_policy_container.csp_list);
LibWeb: Make PolicyContainer GC allocated This is required to store Content Security Policies, as their Directives are implemented as subclasses with overridden virtual functions. Thus, they cannot be stored as generic Directive classes, as it'll lose the ability to call overridden functions when they are copied.
2024-11-25 14:30:12 +00:00
result->embedder_policy = serialized_policy_container.embedder_policy;
result->referrer_policy = serialized_policy_container.referrer_policy;
return result;
LibWeb: Add facilities to serialize EnvironmentSettingsObjects This will be used to transfer information about the parent context to DedicatedWorkers and future out-of-process Worker/Worklet implementations for fetching purposes. In order to properly check same-origin and other policies, we need to know more about the outside settings than we were previously passing to the WebWorker process.
2024-03-05 09:29:14 -07:00
}
LibWeb: Make PolicyContainer GC allocated This is required to store Content Security Policies, as their Directives are implemented as subclasses with overridden virtual functions. Thus, they cannot be stored as generic Directive classes, as it'll lose the ability to call overridden functions when they are copied.
2024-11-25 14:30:12 +00:00
// https://html.spec.whatwg.org/multipage/browsers.html#clone-a-policy-container
GC::Ref<PolicyContainer> PolicyContainer::clone(JS::Realm& realm) const
LibWeb: Add facilities to serialize EnvironmentSettingsObjects This will be used to transfer information about the parent context to DedicatedWorkers and future out-of-process Worker/Worklet implementations for fetching purposes. In order to properly check same-origin and other policies, we need to know more about the outside settings than we were previously passing to the WebWorker process.
2024-03-05 09:29:14 -07:00
{
LibWeb: Make PolicyContainer GC allocated This is required to store Content Security Policies, as their Directives are implemented as subclasses with overridden virtual functions. Thus, they cannot be stored as generic Directive classes, as it'll lose the ability to call overridden functions when they are copied.
2024-11-25 14:30:12 +00:00
// 1. Let clone be a new policy container.
auto clone = realm.create<PolicyContainer>(realm);
LibWeb: Add facilities to serialize EnvironmentSettingsObjects This will be used to transfer information about the parent context to DedicatedWorkers and future out-of-process Worker/Worklet implementations for fetching purposes. In order to properly check same-origin and other policies, we need to know more about the outside settings than we were previously passing to the WebWorker process.
2024-03-05 09:29:14 -07:00
LibWeb: Introduce Content Security Policy policies and directives These form the basis of Content Security Policy. A policy is a collection of directives that are parsed from either the Content-Security-Policy(-Report-Only) HTTP header, or the `<meta>` element. The directives are what restrict the operations can be performed in the current global execution context. For example, "frame-ancestors: none" tells us to prevent the page from being loaded in an embedded context, such as `<iframe>`. You can see it a bit like OpenBSD's pledge() functionality, but for the web platform: https://man.openbsd.org/pledge.2
2024-11-25 16:17:17 +00:00
// 2. For each policy in policyContainer's CSP list, append a copy of policy into clone's CSP list.
clone->csp_list = csp_list->clone(realm);
LibWeb: Make PolicyContainer GC allocated This is required to store Content Security Policies, as their Directives are implemented as subclasses with overridden virtual functions. Thus, they cannot be stored as generic Directive classes, as it'll lose the ability to call overridden functions when they are copied.
2024-11-25 14:30:12 +00:00
// 3. Set clone's embedder policy to a copy of policyContainer's embedder policy.
// NOTE: This is a C++ copy.
clone->embedder_policy = embedder_policy;
// 4. Set clone's referrer policy to policyContainer's referrer policy.
clone->referrer_policy = referrer_policy;
// 5. Return clone.
return clone;
}
SerializedPolicyContainer PolicyContainer::serialize() const
{
return SerializedPolicyContainer {
LibWeb: Introduce Content Security Policy policies and directives These form the basis of Content Security Policy. A policy is a collection of directives that are parsed from either the Content-Security-Policy(-Report-Only) HTTP header, or the `<meta>` element. The directives are what restrict the operations can be performed in the current global execution context. For example, "frame-ancestors: none" tells us to prevent the page from being loaded in an embedded context, such as `<iframe>`. You can see it a bit like OpenBSD's pledge() functionality, but for the web platform: https://man.openbsd.org/pledge.2
2024-11-25 16:17:17 +00:00
.csp_list = csp_list->serialize(),
LibWeb: Make PolicyContainer GC allocated This is required to store Content Security Policies, as their Directives are implemented as subclasses with overridden virtual functions. Thus, they cannot be stored as generic Directive classes, as it'll lose the ability to call overridden functions when they are copied.
2024-11-25 14:30:12 +00:00
.embedder_policy = embedder_policy,
.referrer_policy = referrer_policy,
};
LibWeb: Add facilities to serialize EnvironmentSettingsObjects This will be used to transfer information about the parent context to DedicatedWorkers and future out-of-process Worker/Worklet implementations for fetching purposes. In order to properly check same-origin and other policies, we need to know more about the outside settings than we were previously passing to the WebWorker process.
2024-03-05 09:29:14 -07:00
}
LibWeb: Introduce Content Security Policy policies and directives These form the basis of Content Security Policy. A policy is a collection of directives that are parsed from either the Content-Security-Policy(-Report-Only) HTTP header, or the `<meta>` element. The directives are what restrict the operations can be performed in the current global execution context. For example, "frame-ancestors: none" tells us to prevent the page from being loaded in an embedded context, such as `<iframe>`. You can see it a bit like OpenBSD's pledge() functionality, but for the web platform: https://man.openbsd.org/pledge.2
2024-11-25 16:17:17 +00:00
void PolicyContainer::visit_edges(Cell::Visitor& visitor)
{
Base::visit_edges(visitor);
visitor.visit(csp_list);
}
LibWeb: Add facilities to serialize EnvironmentSettingsObjects This will be used to transfer information about the parent context to DedicatedWorkers and future out-of-process Worker/Worklet implementations for fetching purposes. In order to properly check same-origin and other policies, we need to know more about the outside settings than we were previously passing to the WebWorker process.
2024-03-05 09:29:14 -07:00
}
Reference in a new issue Copy permalink