1/*
2 * Copyright (C) 2011 Adam Barth. All Rights Reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 *
13 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
14 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
16 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
17 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
18 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
19 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
20 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
21 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
23 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26#pragma once
27
28#include "HTMLToken.h"
29#include "HTTPParsers.h"
30#include <wtf/URL.h>
31#include "SuffixTree.h"
32#include "TextEncoding.h"
33
34namespace WebCore {
35
36class Document;
37class HTMLDocumentParser;
38class HTMLSourceTracker;
39class XSSInfo;
40class XSSAuditorDelegate;
41
42struct FilterTokenRequest {
43 FilterTokenRequest(HTMLToken& token, HTMLSourceTracker& sourceTracker, bool shouldAllowCDATA)
44 : token(token)
45 , sourceTracker(sourceTracker)
46 , shouldAllowCDATA(shouldAllowCDATA)
47 { }
48
49 HTMLToken& token;
50 HTMLSourceTracker& sourceTracker;
51 bool shouldAllowCDATA;
52};
53
54class XSSAuditor {
55 WTF_MAKE_NONCOPYABLE(XSSAuditor);
56public:
57 XSSAuditor();
58
59 void init(Document*, XSSAuditorDelegate*);
60 void initForFragment();
61
62 std::unique_ptr<XSSInfo> filterToken(const FilterTokenRequest&);
63
64private:
65 static const size_t kMaximumFragmentLengthTarget = 100;
66
67 enum State {
68 Uninitialized,
69 Initialized
70 };
71
72 enum class TruncationStyle {
73 None,
74 NormalAttribute,
75 SrcLikeAttribute,
76 ScriptLikeAttribute
77 };
78
79 bool filterStartToken(const FilterTokenRequest&);
80 void filterEndToken(const FilterTokenRequest&);
81 bool filterCharacterToken(const FilterTokenRequest&);
82 bool filterScriptToken(const FilterTokenRequest&);
83 bool filterObjectToken(const FilterTokenRequest&);
84 bool filterParamToken(const FilterTokenRequest&);
85 bool filterEmbedToken(const FilterTokenRequest&);
86 bool filterAppletToken(const FilterTokenRequest&);
87 bool filterFrameToken(const FilterTokenRequest&);
88 bool filterMetaToken(const FilterTokenRequest&);
89 bool filterBaseToken(const FilterTokenRequest&);
90 bool filterFormToken(const FilterTokenRequest&);
91 bool filterInputToken(const FilterTokenRequest&);
92 bool filterButtonToken(const FilterTokenRequest&);
93
94 bool eraseDangerousAttributesIfInjected(const FilterTokenRequest&);
95 bool eraseAttributeIfInjected(const FilterTokenRequest&, const QualifiedName&, const String& replacementValue = String(), TruncationStyle = TruncationStyle::NormalAttribute);
96
97 String canonicalizedSnippetForTagName(const FilterTokenRequest&);
98 String canonicalizedSnippetForJavaScript(const FilterTokenRequest&);
99 String snippetFromAttribute(const FilterTokenRequest&, const HTMLToken::Attribute&);
100 String canonicalize(const String&, TruncationStyle);
101
102 bool isContainedInRequest(const String&);
103 bool isLikelySafeResource(const String& url);
104
105 SuffixTree<ASCIICodebook>* decodedHTTPBodySuffixTree();
106
107 URL m_documentURL;
108 bool m_isEnabled;
109
110 XSSProtectionDisposition m_xssProtection;
111 bool m_didSendValidXSSProtectionHeader;
112
113 String m_decodedURL;
114 String m_decodedHTTPBody;
115 std::unique_ptr<SuffixTree<ASCIICodebook>> m_decodedHTTPBodySuffixTree;
116
117 State m_state;
118 bool m_wasScriptTagFoundInRequest { false };
119 unsigned m_scriptTagNestingLevel;
120 TextEncoding m_encoding;
121};
122
123} // namespace WebCore
124