Stowage/ladybird
2
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-12-08 06:09:58 +00:00
Code Issues Projects Releases Packages Wiki Activity

LibWeb: Extract some CORS and MIME Fetch helpers to their own files

Browse source 
An upcoming commit will migrate the contents of Headers.h/cpp to LibHTTP
for use outside of LibWeb. These CORS and MIME helpers depend on other
LibWeb facilities, however, so they cannot be moved.
This commit is contained in:
Timothy Flynn 2025-11-26 13:32:39 -05:00 • committed by Jelle Raaijmakers
parent 0fd80a8f99
commit 3dce6766a3
Notes: github-actions[bot] 2025-11-27 13:58:58 +00:00
30 changed files with 382 additions and 299 deletions
Download patch file Download diff file Expand all files Collapse all files

263
Libraries/LibWeb/Fetch/Infrastructure/HTTP/Headers.cpp
View file

@ -19,7 +19,6 @@
#include <LibWeb/Fetch/Infrastructure/HTTP/Headers.h>
#include <LibWeb/Fetch/Infrastructure/HTTP/Methods.h>
#include <LibWeb/Loader/ResourceLoader.h>
#include <LibWeb/MimeSniff/MimeType.h>
namespace Web::Fetch::Infrastructure {
@ -311,61 +310,6 @@ Variant<Empty, u64, HeaderList::ExtractLengthFailure> HeaderList::extract_length
return *result;
}
// https://fetch.spec.whatwg.org/#concept-header-extract-mime-type
Optional<MimeSniff::MimeType> HeaderList::extract_mime_type() const
{
// 1. Let charset be null.
Optional<String> charset;
// 2. Let essence be null.
Optional<String> essence;
// 3. Let mimeType be null.
Optional<MimeSniff::MimeType> mime_type;
// 4. Let values be the result of getting, decoding, and splitting `Content-Type` from headers.
auto values = get_decode_and_split("Content-Type"sv);
// 5. If values is null, then return failure.
if (!values.has_value())
return {};
// 6. For each value of values:
for (auto const& value : *values) {
// 1. Let temporaryMimeType be the result of parsing value.
auto temporary_mime_type = MimeSniff::MimeType::parse(value);
// 2. If temporaryMimeType is failure or its essence is "*/*", then continue.
if (!temporary_mime_type.has_value() || temporary_mime_type->essence() == "*/*"sv)
continue;
// 3. Set mimeType to temporaryMimeType.
mime_type = temporary_mime_type;
// 4. If mimeType’s essence is not essence, then:
if (!essence.has_value() || (mime_type->essence() != essence->bytes_as_string_view())) {
// 1. Set charset to null.
charset = {};
// 2. If mimeType’s parameters["charset"] exists, then set charset to mimeType’s parameters["charset"].
auto it = mime_type->parameters().find("charset"sv);
if (it != mime_type->parameters().end())
charset = it->value;
// 3. Set essence to mimeType’s essence.
essence = mime_type->essence();
}
// 5. Otherwise, if mimeType’s parameters["charset"] does not exist, and charset is non-null, set mimeType’s parameters["charset"] to charset.
else if (!mime_type->parameters().contains("charset"sv) && charset.has_value()) {
mime_type->set_parameter("charset"_string, charset.release_value());
}
}
// 7. If mimeType is null, then return failure.
// 8. Return mimeType.
return mime_type;
}
// Non-standard
Vector<ByteString> HeaderList::unique_names() const
{
@ -494,29 +438,6 @@ bool is_forbidden_response_header_name(StringView header_name)
"Set-Cookie2"sv);
}
// https://fetch.spec.whatwg.org/#legacy-extract-an-encoding
StringView legacy_extract_an_encoding(Optional<MimeSniff::MimeType> const& mime_type, StringView fallback_encoding)
{
// 1. If mimeType is failure, then return fallbackEncoding.
if (!mime_type.has_value())
return fallback_encoding;
// 2. If mimeType["charset"] does not exist, then return fallbackEncoding.
auto charset = mime_type->parameters().get("charset"sv);
if (!charset.has_value())
return fallback_encoding;
// 3. Let tentativeEncoding be the result of getting an encoding from mimeType["charset"].
auto tentative_encoding = TextCodec::get_standardized_encoding(*charset);
// 4. If tentativeEncoding is failure, then return fallbackEncoding.
if (!tentative_encoding.has_value())
return fallback_encoding;
// 5. Return tentativeEncoding.
return *tentative_encoding;
}
// https://fetch.spec.whatwg.org/#header-value-get-decode-and-split
Vector<String> get_decode_and_split_header_value(StringView value)
{
@ -676,190 +597,6 @@ Optional<RangeHeaderValue> parse_single_range_header_value(StringView const valu
return RangeHeaderValue { move(range_start_value), move(range_end_value) };
}
// https://fetch.spec.whatwg.org/#cors-safelisted-request-header
bool is_cors_safelisted_request_header(Header const& header)
{
// To determine whether a header (name, value) is a CORS-safelisted request-header, run these steps:
auto const& [name, value] = header;
// 1. If value’s length is greater than 128, then return false.
if (value.length() > 128)
return false;
// 2. Byte-lowercase name and switch on the result:
// `accept`
if (name.equals_ignoring_ascii_case("accept"sv)) {
// If value contains a CORS-unsafe request-header byte, then return false.
if (any_of(value, is_cors_unsafe_request_header_byte))
return false;
}
// `accept-language`
// `content-language`
else if (name.is_one_of_ignoring_ascii_case("accept-language"sv, "content-language"sv)) {
// If value contains a byte that is not in the range 0x30 (0) to 0x39 (9), inclusive, is not in the range 0x41 (A) to 0x5A (Z), inclusive, is not in the range 0x61 (a) to 0x7A (z), inclusive, and is not 0x20 (SP), 0x2A (*), 0x2C (,), 0x2D (-), 0x2E (.), 0x3B (;), or 0x3D (=), then return false.
if (any_of(value, [](auto byte) {
return !(is_ascii_digit(byte) || is_ascii_alpha(byte) || " *,-.;="sv.contains(byte));
}))
return false;
}
// `content-type`
else if (name.equals_ignoring_ascii_case("content-type"sv)) {
// 1. If value contains a CORS-unsafe request-header byte, then return false.
if (any_of(value, is_cors_unsafe_request_header_byte))
return false;
// 2. Let mimeType be the result of parsing the result of isomorphic decoding value.
auto decoded = TextCodec::isomorphic_decode(value);
auto mime_type = MimeSniff::MimeType::parse(decoded);
// 3. If mimeType is failure, then return false.
if (!mime_type.has_value())
return false;
// 4. If mimeType’s essence is not "application/x-www-form-urlencoded", "multipart/form-data", or "text/plain", then return false.
if (!mime_type->essence().is_one_of("application/x-www-form-urlencoded"sv, "multipart/form-data"sv, "text/plain"sv))
return false;
}
// `range`
else if (name.equals_ignoring_ascii_case("range"sv)) {
// 1. Let rangeValue be the result of parsing a single range header value given value and false.
auto range_value = parse_single_range_header_value(value, false);
// 2. If rangeValue is failure, then return false.
if (!range_value.has_value())
return false;
// 3. If rangeValue[0] is null, then return false.
// NOTE: As web browsers have historically not emitted ranges such as `bytes=-500` this algorithm does not safelist them.
if (!range_value->start.has_value())
return false;
}
// Otherwise
else {
// Return false.
return false;
}
// 3. Return true.
return true;
}
// https://fetch.spec.whatwg.org/#cors-unsafe-request-header-byte
bool is_cors_unsafe_request_header_byte(u8 byte)
{
// A CORS-unsafe request-header byte is a byte byte for which one of the following is true:
// - byte is less than 0x20 and is not 0x09 HT
// - byte is 0x22 ("), 0x28 (left parenthesis), 0x29 (right parenthesis), 0x3A (:), 0x3C (<), 0x3E (>), 0x3F (?), 0x40 (@), 0x5B ([), 0x5C (\), 0x5D (]), 0x7B ({), 0x7D (}), or 0x7F DEL.
return (byte < 0x20 && byte != 0x09)
|| (Array<u8, 14> { 0x22, 0x28, 0x29, 0x3A, 0x3C, 0x3E, 0x3F, 0x40, 0x5B, 0x5C, 0x5D, 0x7B, 0x7D, 0x7F }.span().contains_slow(byte));
}
// https://fetch.spec.whatwg.org/#cors-unsafe-request-header-names
Vector<ByteString> get_cors_unsafe_header_names(HeaderList const& headers)
{
// The CORS-unsafe request-header names, given a header list headers, are determined as follows:
// 1. Let unsafeNames be a new list.
Vector<ByteString> unsafe_names;
// 2. Let potentiallyUnsafeNames be a new list.
Vector<ByteString> potentially_unsafe_names;
// 3. Let safelistValueSize be 0.
Checked<size_t> safelist_value_size = 0;
// 4. For each header of headers:
for (auto const& header : headers) {
// 1. If header is not a CORS-safelisted request-header, then append header’s name to unsafeNames.
if (!is_cors_safelisted_request_header(header)) {
unsafe_names.append(header.name);
}
// 2. Otherwise, append header’s name to potentiallyUnsafeNames and increase safelistValueSize by header’s
// value’s length.
else {
potentially_unsafe_names.append(header.name);
safelist_value_size += header.value.length();
}
}
// 5. If safelistValueSize is greater than 1024, then for each name of potentiallyUnsafeNames, append name to
// unsafeNames.
if (safelist_value_size.has_overflow() || safelist_value_size.value() > 1024)
unsafe_names.extend(move(potentially_unsafe_names));
// 6. Return the result of convert header names to a sorted-lowercase set with unsafeNames.
return convert_header_names_to_a_sorted_lowercase_set(unsafe_names);
}
// https://fetch.spec.whatwg.org/#cors-non-wildcard-request-header-name
bool is_cors_non_wildcard_request_header_name(StringView header_name)
{
// A CORS non-wildcard request-header name is a header name that is a byte-case-insensitive match for `Authorization`.
return header_name.equals_ignoring_ascii_case("Authorization"sv);
}
// https://fetch.spec.whatwg.org/#privileged-no-cors-request-header-name
bool is_privileged_no_cors_request_header_name(StringView header_name)
{
// A privileged no-CORS request-header name is a header name that is a byte-case-insensitive match for one of
// - `Range`.
return header_name.equals_ignoring_ascii_case("Range"sv);
}
// https://fetch.spec.whatwg.org/#cors-safelisted-response-header-name
bool is_cors_safelisted_response_header_name(StringView header_name, ReadonlySpan<StringView> list)
{
// A CORS-safelisted response-header name, given a list of header names list, is a header name that is a byte-case-insensitive match for one of
// - `Cache-Control`
// - `Content-Language`
// - `Content-Length`
// - `Content-Type`
// - `Expires`
// - `Last-Modified`
// - `Pragma`
// - Any item in list that is not a forbidden response-header name.
return header_name.is_one_of_ignoring_ascii_case(
"Cache-Control"sv,
"Content-Language"sv,
"Content-Length"sv,
"Content-Type"sv,
"Expires"sv,
"Last-Modified"sv,
"Pragma"sv)
|| any_of(list, [&](auto list_header_name) {
return header_name.equals_ignoring_ascii_case(list_header_name)
&& !is_forbidden_response_header_name(list_header_name);
});
}
// https://fetch.spec.whatwg.org/#no-cors-safelisted-request-header-name
bool is_no_cors_safelisted_request_header_name(StringView header_name)
{
// A no-CORS-safelisted request-header name is a header name that is a byte-case-insensitive match for one of
// - `Accept`
// - `Accept-Language`
// - `Content-Language`
// - `Content-Type`
return header_name.is_one_of_ignoring_ascii_case(
"Accept"sv,
"Accept-Language"sv,
"Content-Language"sv,
"Content-Type"sv);
}
// https://fetch.spec.whatwg.org/#no-cors-safelisted-request-header
bool is_no_cors_safelisted_request_header(Header const& header)
{
// To determine whether a header (name, value) is a no-CORS-safelisted request-header, run these steps:
// 1. If name is not a no-CORS-safelisted request-header name, then return false.
if (!is_no_cors_safelisted_request_header_name(header.name))
return false;
// 2. Return whether (name, value) is a CORS-safelisted request-header.
return is_cors_safelisted_request_header(header);
}
// https://fetch.spec.whatwg.org/#default-user-agent-value
ByteString const& default_user_agent_value()
{