1/*
2 * Copyright (C) 2017 Yusuke Suzuki <utatane.tea@gmail.com>
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 *
13 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
14 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
16 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
17 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
18 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
19 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
20 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
21 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
23 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26#include "config.h"
27#include "CachedScriptFetcher.h"
28
29#include "CachedResourceLoader.h"
30#include "CachedScript.h"
31#include "ContentSecurityPolicy.h"
32#include "CrossOriginAccessControl.h"
33#include "Document.h"
34#include "Settings.h"
35
36namespace WebCore {
37
38Ref<CachedScriptFetcher> CachedScriptFetcher::create(const String& charset)
39{
40 return adoptRef(*new CachedScriptFetcher(charset));
41}
42
43CachedResourceHandle<CachedScript> CachedScriptFetcher::requestModuleScript(Document& document, const URL& sourceURL, String&& integrity) const
44{
45 return requestScriptWithCache(document, sourceURL, String { }, WTFMove(integrity));
46}
47
48CachedResourceHandle<CachedScript> CachedScriptFetcher::requestScriptWithCache(Document& document, const URL& sourceURL, const String& crossOriginMode, String&& integrity) const
49{
50 if (!document.settings().isScriptEnabled())
51 return nullptr;
52
53 ASSERT(document.contentSecurityPolicy());
54 bool hasKnownNonce = document.contentSecurityPolicy()->allowScriptWithNonce(m_nonce, m_isInUserAgentShadowTree);
55 ResourceLoaderOptions options = CachedResourceLoader::defaultCachedResourceOptions();
56 options.contentSecurityPolicyImposition = hasKnownNonce ? ContentSecurityPolicyImposition::SkipPolicyCheck : ContentSecurityPolicyImposition::DoPolicyCheck;
57 options.sameOriginDataURLFlag = SameOriginDataURLFlag::Set;
58 options.integrity = WTFMove(integrity);
59
60 auto request = createPotentialAccessControlRequest(sourceURL, document, crossOriginMode, WTFMove(options));
61 request.upgradeInsecureRequestIfNeeded(document);
62 request.setCharset(m_charset);
63 if (!m_initiatorName.isNull())
64 request.setInitiator(m_initiatorName);
65 return document.cachedResourceLoader().requestScript(WTFMove(request)).value_or(nullptr);
66}
67
68}
69