mirror of
https://github.com/LadybirdBrowser/ladybird.git
synced 2025-01-23 09:46:04 -05:00
156f9fff32
Navigation responses are now checked for adherence to the `X-Frame-Options` header and an error is shown accordingly.
97 lines
3.6 KiB
C++
97 lines
3.6 KiB
C++
/*
|
|
* Copyright (c) 2024, Aliaksandr Kalenik <kalenik.aliaksandr@gmail.com>
|
|
*
|
|
* SPDX-License-Identifier: BSD-2-Clause
|
|
*/
|
|
|
|
#include <LibWeb/DOM/Document.h>
|
|
#include <LibWeb/Fetch/Infrastructure/FetchController.h>
|
|
#include <LibWeb/HTML/Navigable.h>
|
|
#include <LibWeb/HTML/NavigationParams.h>
|
|
#include <LibWeb/HTML/Scripting/Environments.h>
|
|
|
|
namespace Web::HTML {
|
|
|
|
GC_DEFINE_ALLOCATOR(NavigationParams);
|
|
GC_DEFINE_ALLOCATOR(NonFetchSchemeNavigationParams);
|
|
|
|
void NavigationParams::visit_edges(Visitor& visitor)
|
|
{
|
|
Base::visit_edges(visitor);
|
|
visitor.visit(navigable);
|
|
visitor.visit(request);
|
|
visitor.visit(response);
|
|
visitor.visit(fetch_controller);
|
|
visitor.visit(reserved_environment);
|
|
}
|
|
|
|
void NonFetchSchemeNavigationParams::visit_edges(Visitor& visitor)
|
|
{
|
|
Base::visit_edges(visitor);
|
|
visitor.visit(navigable);
|
|
}
|
|
|
|
// https://html.spec.whatwg.org/multipage/document-lifecycle.html#check-a-navigation-response's-adherence-to-x-frame-options
|
|
// FIXME: Add the cspList parameter
|
|
bool check_a_navigation_responses_adherence_to_x_frame_options(GC::Ptr<Fetch::Infrastructure::Response> response, Navigable* navigable, URL::Origin destination_origin)
|
|
{
|
|
// 1. If navigable is not a child navigable, then return true.
|
|
if (!navigable->parent()) {
|
|
return true;
|
|
}
|
|
|
|
// FIXME: 2. For each policy of cspList:
|
|
// 1. If policy's disposition is not "enforce", then continue.
|
|
// 2. If policy's directive set contains a frame-ancestors directive, then return true.
|
|
|
|
// 3. Let rawXFrameOptions be the result of getting, decoding, and splitting `X-Frame-Options` from response's header list.
|
|
auto raw_x_frame_options = response->header_list()->get_decode_and_split("X-Frame-Options"sv.bytes());
|
|
|
|
// 4. Let xFrameOptions be a new set.
|
|
auto x_frame_options = AK::OrderedHashTable<String>();
|
|
|
|
// 5. For each value of rawXFrameOptions, append value, converted to ASCII lowercase, to xFrameOptions.
|
|
if (raw_x_frame_options.has_value()) {
|
|
for (auto const& value : raw_x_frame_options.value()) {
|
|
x_frame_options.set(value.to_ascii_lowercase());
|
|
}
|
|
}
|
|
|
|
// 6. If xFrameOptions's size is greater than 1, and xFrameOptions contains any of "deny", "allowall", or "sameorigin", then return false.
|
|
if (x_frame_options.size() > 1 && (x_frame_options.contains("deny"sv) || x_frame_options.contains("allowall"sv) || x_frame_options.contains("sameorigin"sv))) {
|
|
return false;
|
|
}
|
|
|
|
// 7. If xFrameOptions's size is greater than 1, then return true.
|
|
if (x_frame_options.size() > 1) {
|
|
return true;
|
|
}
|
|
|
|
// 8. If xFrameOptions[0] is "deny", then return false.
|
|
auto first_x_frame_option = x_frame_options.begin();
|
|
if (!x_frame_options.is_empty() && *first_x_frame_option == "deny"sv) {
|
|
return false;
|
|
}
|
|
|
|
// 9. If xFrameOptions[0] is "sameorigin", then:
|
|
if (!x_frame_options.is_empty() && *first_x_frame_option == "sameorigin"sv) {
|
|
// 1. Let containerDocument be navigable's container document.
|
|
auto container_document = navigable->container_document();
|
|
|
|
// 2. While containerDocument is not null:
|
|
while (container_document) {
|
|
// 1. If containerDocument's origin is not same origin with destinationOrigin, then return false.
|
|
if (!container_document->origin().is_same_origin(destination_origin)) {
|
|
return false;
|
|
}
|
|
|
|
// 2. Set containerDocument to containerDocument's container document.
|
|
container_document = container_document->container_document();
|
|
}
|
|
}
|
|
|
|
// 10. Return true.
|
|
return true;
|
|
}
|
|
|
|
}
|