1/*
2 * Copyright (C) 2010 Apple Inc. All Rights Reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 *
13 * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
14 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
16 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
17 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
18 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
19 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
20 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
21 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
23 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 *
25 */
26#include "config.h"
27#include "SchemeRegistry.h"
28
29#include <wtf/Lock.h>
30#include <wtf/Locker.h>
31#include <wtf/MainThread.h>
32#include <wtf/NeverDestroyed.h>
33#include <wtf/URLParser.h>
34
35#if ENABLE(CONTENT_FILTERING)
36#include "ContentFilter.h"
37#endif
38#if USE(QUICK_LOOK)
39#include "QuickLook.h"
40#endif
41
42namespace WebCore {
43
44// FIXME: URLSchemesMap is a peculiar type name given that it is a set.
45
46static const URLSchemesMap& builtinLocalURLSchemes();
47static const Vector<String>& builtinSecureSchemes();
48static const Vector<String>& builtinSchemesWithUniqueOrigins();
49static const Vector<String>& builtinEmptyDocumentSchemes();
50static const Vector<String>& builtinCanDisplayOnlyIfCanRequestSchemes();
51static const Vector<String>& builtinCORSEnabledSchemes();
52
53using StringVectorFunction = const Vector<String>& (*)();
54
55static void add(URLSchemesMap& set, StringVectorFunction function)
56{
57 for (auto& scheme : function())
58 set.add(scheme);
59}
60
61static NeverDestroyed<URLSchemesMap> makeNeverDestroyedSchemeSet(const Vector<String>& (*function)())
62{
63 URLSchemesMap set;
64 add(set, function);
65 return set;
66}
67
68static Lock schemeRegistryLock;
69
70static const URLSchemesMap& allBuiltinSchemes()
71{
72 static const auto schemes = makeNeverDestroyed([] {
73 static const StringVectorFunction functions[] {
74 builtinSecureSchemes,
75 builtinSchemesWithUniqueOrigins,
76 builtinEmptyDocumentSchemes,
77 builtinCanDisplayOnlyIfCanRequestSchemes,
78 builtinCORSEnabledSchemes,
79 };
80
81 // Other misc schemes that the SchemeRegistry doesn't know about.
82 static const char* const otherSchemes[] = {
83 "webkit-fake-url",
84#if PLATFORM(MAC)
85 "safari-extension",
86#endif
87#if USE(QUICK_LOOK)
88 QLPreviewProtocol,
89#endif
90#if ENABLE(CONTENT_FILTERING)
91 ContentFilter::urlScheme(),
92#endif
93 };
94
95 URLSchemesMap set;
96 {
97 Locker<Lock> locker(schemeRegistryLock);
98 for (auto& scheme : builtinLocalURLSchemes())
99 set.add(scheme);
100
101 for (auto& function : functions)
102 add(set, function);
103 }
104 for (auto& scheme : otherSchemes)
105 set.add(scheme);
106 return set;
107 }());
108 return schemes;
109}
110
111static const URLSchemesMap& builtinLocalURLSchemes()
112{
113 ASSERT(schemeRegistryLock.isHeld());
114 static const auto schemes = makeNeverDestroyed(URLSchemesMap {
115 "file",
116#if PLATFORM(COCOA)
117 "applewebdata",
118#endif
119 });
120 return schemes;
121}
122
123static URLSchemesMap& localURLSchemes()
124{
125 ASSERT(schemeRegistryLock.isHeld());
126 static NeverDestroyed<URLSchemesMap> localSchemes = builtinLocalURLSchemes();
127 return localSchemes;
128}
129
130static URLSchemesMap& displayIsolatedURLSchemes()
131{
132 ASSERT(schemeRegistryLock.isHeld());
133 static NeverDestroyed<URLSchemesMap> displayIsolatedSchemes;
134 return displayIsolatedSchemes;
135}
136
137const Vector<String>& builtinSecureSchemes()
138{
139 ASSERT(schemeRegistryLock.isHeld());
140 static const auto schemes = makeNeverDestroyed(Vector<String> {
141 "https",
142 "about",
143 "data",
144 "wss",
145#if PLATFORM(GTK) || PLATFORM(WPE)
146 "resource",
147#endif
148 });
149 return schemes;
150}
151
152static URLSchemesMap& secureSchemes()
153{
154 ASSERT(schemeRegistryLock.isHeld());
155 static auto secureSchemes = makeNeverDestroyedSchemeSet(builtinSecureSchemes);
156 return secureSchemes;
157}
158
159const Vector<String>& builtinSchemesWithUniqueOrigins()
160{
161 ASSERT(schemeRegistryLock.isHeld());
162 static const auto schemes = makeNeverDestroyed(Vector<String> {
163 "about",
164 "javascript",
165 // This is an intentional difference from the behavior the HTML specification calls for.
166 // See https://bugs.webkit.org/show_bug.cgi?id=11885
167 "data",
168 });
169 return schemes;
170}
171
172static URLSchemesMap& schemesWithUniqueOrigins()
173{
174 ASSERT(schemeRegistryLock.isHeld());
175 static auto schemesWithUniqueOrigins = makeNeverDestroyedSchemeSet(builtinSchemesWithUniqueOrigins);
176 return schemesWithUniqueOrigins;
177}
178
179const Vector<String>& builtinEmptyDocumentSchemes()
180{
181 ASSERT(isMainThread());
182 static const auto schemes = makeNeverDestroyed(Vector<String> { "about" });
183 return schemes;
184}
185
186static URLSchemesMap& emptyDocumentSchemes()
187{
188 ASSERT(isMainThread());
189 static auto emptyDocumentSchemes = makeNeverDestroyedSchemeSet(builtinEmptyDocumentSchemes);
190 return emptyDocumentSchemes;
191}
192
193static URLSchemesMap& schemesForbiddenFromDomainRelaxation()
194{
195 ASSERT(isMainThread());
196 static NeverDestroyed<URLSchemesMap> schemes;
197 return schemes;
198}
199
200const Vector<String>& builtinCanDisplayOnlyIfCanRequestSchemes()
201{
202 ASSERT(schemeRegistryLock.isHeld());
203 static const auto schemes = makeNeverDestroyed(Vector<String> { "blob" });
204 return schemes;
205}
206
207static URLSchemesMap& canDisplayOnlyIfCanRequestSchemes()
208{
209 ASSERT(schemeRegistryLock.isHeld());
210 static auto canDisplayOnlyIfCanRequestSchemes = makeNeverDestroyedSchemeSet(builtinCanDisplayOnlyIfCanRequestSchemes);
211 return canDisplayOnlyIfCanRequestSchemes;
212}
213
214static URLSchemesMap& notAllowingJavascriptURLsSchemes()
215{
216 ASSERT(isMainThread());
217 static NeverDestroyed<URLSchemesMap> notAllowingJavascriptURLsSchemes;
218 return notAllowingJavascriptURLsSchemes;
219}
220
221void SchemeRegistry::registerURLSchemeAsLocal(const String& scheme)
222{
223 if (scheme.isNull())
224 return;
225
226 Locker<Lock> locker(schemeRegistryLock);
227 localURLSchemes().add(scheme);
228}
229
230void SchemeRegistry::removeURLSchemeRegisteredAsLocal(const String& scheme)
231{
232 Locker<Lock> locker(schemeRegistryLock);
233 if (builtinLocalURLSchemes().contains(scheme))
234 return;
235
236 localURLSchemes().remove(scheme);
237}
238
239static URLSchemesMap& schemesAllowingLocalStorageAccessInPrivateBrowsing()
240{
241 ASSERT(isMainThread());
242 static NeverDestroyed<URLSchemesMap> schemesAllowingLocalStorageAccessInPrivateBrowsing;
243 return schemesAllowingLocalStorageAccessInPrivateBrowsing;
244}
245
246static URLSchemesMap& schemesAllowingDatabaseAccessInPrivateBrowsing()
247{
248 ASSERT(isMainThread());
249 static NeverDestroyed<URLSchemesMap> schemesAllowingDatabaseAccessInPrivateBrowsing;
250 return schemesAllowingDatabaseAccessInPrivateBrowsing;
251}
252
253const Vector<String>& builtinCORSEnabledSchemes()
254{
255 ASSERT(isMainThread());
256 static const auto schemes = makeNeverDestroyed(Vector<String> { "http", "https" });
257 return schemes;
258}
259
260static URLSchemesMap& CORSEnabledSchemes()
261{
262 ASSERT(isMainThread());
263 // FIXME: http://bugs.webkit.org/show_bug.cgi?id=77160
264 static auto schemes = makeNeverDestroyedSchemeSet(builtinCORSEnabledSchemes);
265 return schemes;
266}
267
268static URLSchemesMap& ContentSecurityPolicyBypassingSchemes()
269{
270 ASSERT(schemeRegistryLock.isHeld());
271 static NeverDestroyed<URLSchemesMap> schemes;
272 return schemes;
273}
274
275static URLSchemesMap& cachePartitioningSchemes()
276{
277 ASSERT(schemeRegistryLock.isHeld());
278 static NeverDestroyed<URLSchemesMap> schemes;
279 return schemes;
280}
281
282static URLSchemesMap& serviceWorkerSchemes()
283{
284 ASSERT(schemeRegistryLock.isHeld());
285 static NeverDestroyed<URLSchemesMap> schemes;
286 return schemes;
287}
288
289static URLSchemesMap& alwaysRevalidatedSchemes()
290{
291 ASSERT(isMainThread());
292 static NeverDestroyed<URLSchemesMap> schemes;
293 return schemes;
294}
295
296bool SchemeRegistry::shouldTreatURLSchemeAsLocal(const String& scheme)
297{
298 if (scheme.isNull())
299 return false;
300
301 Locker<Lock> locker(schemeRegistryLock);
302 return localURLSchemes().contains(scheme);
303}
304
305void SchemeRegistry::registerURLSchemeAsNoAccess(const String& scheme)
306{
307 if (scheme.isNull())
308 return;
309
310 Locker<Lock> locker(schemeRegistryLock);
311 schemesWithUniqueOrigins().add(scheme);
312}
313
314bool SchemeRegistry::shouldTreatURLSchemeAsNoAccess(const String& scheme)
315{
316 if (scheme.isNull())
317 return false;
318
319 Locker<Lock> locker(schemeRegistryLock);
320 return schemesWithUniqueOrigins().contains(scheme);
321}
322
323void SchemeRegistry::registerURLSchemeAsDisplayIsolated(const String& scheme)
324{
325 if (scheme.isNull())
326 return;
327
328 Locker<Lock> locker(schemeRegistryLock);
329 displayIsolatedURLSchemes().add(scheme);
330}
331
332bool SchemeRegistry::shouldTreatURLSchemeAsDisplayIsolated(const String& scheme)
333{
334 if (scheme.isNull())
335 return false;
336
337 Locker<Lock> locker(schemeRegistryLock);
338 return displayIsolatedURLSchemes().contains(scheme);
339}
340
341void SchemeRegistry::registerURLSchemeAsSecure(const String& scheme)
342{
343 if (scheme.isNull())
344 return;
345
346 Locker<Lock> locker(schemeRegistryLock);
347 secureSchemes().add(scheme);
348}
349
350bool SchemeRegistry::shouldTreatURLSchemeAsSecure(const String& scheme)
351{
352 if (scheme.isNull())
353 return false;
354
355 Locker<Lock> locker(schemeRegistryLock);
356 return secureSchemes().contains(scheme);
357}
358
359void SchemeRegistry::registerURLSchemeAsEmptyDocument(const String& scheme)
360{
361 if (scheme.isNull())
362 return;
363 emptyDocumentSchemes().add(scheme);
364}
365
366bool SchemeRegistry::shouldLoadURLSchemeAsEmptyDocument(const String& scheme)
367{
368 return !scheme.isNull() && emptyDocumentSchemes().contains(scheme);
369}
370
371void SchemeRegistry::setDomainRelaxationForbiddenForURLScheme(bool forbidden, const String& scheme)
372{
373 if (scheme.isNull())
374 return;
375
376 if (forbidden)
377 schemesForbiddenFromDomainRelaxation().add(scheme);
378 else
379 schemesForbiddenFromDomainRelaxation().remove(scheme);
380}
381
382bool SchemeRegistry::isDomainRelaxationForbiddenForURLScheme(const String& scheme)
383{
384 return !scheme.isNull() && schemesForbiddenFromDomainRelaxation().contains(scheme);
385}
386
387bool SchemeRegistry::canDisplayOnlyIfCanRequest(const String& scheme)
388{
389 if (scheme.isNull())
390 return false;
391
392 Locker<Lock> locker(schemeRegistryLock);
393 return canDisplayOnlyIfCanRequestSchemes().contains(scheme);
394}
395
396void SchemeRegistry::registerAsCanDisplayOnlyIfCanRequest(const String& scheme)
397{
398 if (scheme.isNull())
399 return;
400
401 Locker<Lock> locker(schemeRegistryLock);
402 canDisplayOnlyIfCanRequestSchemes().add(scheme);
403}
404
405void SchemeRegistry::registerURLSchemeAsNotAllowingJavascriptURLs(const String& scheme)
406{
407 if (scheme.isNull())
408 return;
409 notAllowingJavascriptURLsSchemes().add(scheme);
410}
411
412bool SchemeRegistry::shouldTreatURLSchemeAsNotAllowingJavascriptURLs(const String& scheme)
413{
414 return !scheme.isNull() && notAllowingJavascriptURLsSchemes().contains(scheme);
415}
416
417void SchemeRegistry::registerURLSchemeAsAllowingLocalStorageAccessInPrivateBrowsing(const String& scheme)
418{
419 if (scheme.isNull())
420 return;
421 schemesAllowingLocalStorageAccessInPrivateBrowsing().add(scheme);
422}
423
424bool SchemeRegistry::allowsLocalStorageAccessInPrivateBrowsing(const String& scheme)
425{
426 return !scheme.isNull() && schemesAllowingLocalStorageAccessInPrivateBrowsing().contains(scheme);
427}
428
429void SchemeRegistry::registerURLSchemeAsAllowingDatabaseAccessInPrivateBrowsing(const String& scheme)
430{
431 if (scheme.isNull())
432 return;
433 schemesAllowingDatabaseAccessInPrivateBrowsing().add(scheme);
434}
435
436bool SchemeRegistry::allowsDatabaseAccessInPrivateBrowsing(const String& scheme)
437{
438 return !scheme.isNull() && schemesAllowingDatabaseAccessInPrivateBrowsing().contains(scheme);
439}
440
441void SchemeRegistry::registerURLSchemeAsCORSEnabled(const String& scheme)
442{
443 if (scheme.isNull())
444 return;
445 CORSEnabledSchemes().add(scheme);
446}
447
448bool SchemeRegistry::shouldTreatURLSchemeAsCORSEnabled(const String& scheme)
449{
450 return !scheme.isNull() && CORSEnabledSchemes().contains(scheme);
451}
452
453void SchemeRegistry::registerURLSchemeAsBypassingContentSecurityPolicy(const String& scheme)
454{
455 if (scheme.isNull())
456 return;
457
458 Locker<Lock> locker(schemeRegistryLock);
459 ContentSecurityPolicyBypassingSchemes().add(scheme);
460}
461
462void SchemeRegistry::removeURLSchemeRegisteredAsBypassingContentSecurityPolicy(const String& scheme)
463{
464 if (scheme.isNull())
465 return;
466
467 Locker<Lock> locker(schemeRegistryLock);
468 ContentSecurityPolicyBypassingSchemes().remove(scheme);
469}
470
471bool SchemeRegistry::schemeShouldBypassContentSecurityPolicy(const String& scheme)
472{
473 if (scheme.isNull())
474 return false;
475
476 Locker<Lock> locker(schemeRegistryLock);
477 return ContentSecurityPolicyBypassingSchemes().contains(scheme);
478}
479
480void SchemeRegistry::registerURLSchemeAsAlwaysRevalidated(const String& scheme)
481{
482 if (scheme.isNull())
483 return;
484 alwaysRevalidatedSchemes().add(scheme);
485}
486
487bool SchemeRegistry::shouldAlwaysRevalidateURLScheme(const String& scheme)
488{
489 return !scheme.isNull() && alwaysRevalidatedSchemes().contains(scheme);
490}
491
492void SchemeRegistry::registerURLSchemeAsCachePartitioned(const String& scheme)
493{
494 if (scheme.isNull())
495 return;
496
497 Locker<Lock> locker(schemeRegistryLock);
498 cachePartitioningSchemes().add(scheme);
499}
500
501bool SchemeRegistry::shouldPartitionCacheForURLScheme(const String& scheme)
502{
503 if (scheme.isNull())
504 return false;
505
506 Locker<Lock> locker(schemeRegistryLock);
507 return cachePartitioningSchemes().contains(scheme);
508}
509
510void SchemeRegistry::registerURLSchemeServiceWorkersCanHandle(const String& scheme)
511{
512 if (scheme.isNull())
513 return;
514
515 Locker<Lock> locker(schemeRegistryLock);
516 serviceWorkerSchemes().add(scheme);
517}
518
519bool SchemeRegistry::canServiceWorkersHandleURLScheme(const String& scheme)
520{
521 if (scheme.isNull())
522 return false;
523
524 if (scheme.startsWithIgnoringASCIICase("http"_s)) {
525 if (scheme.length() == 4)
526 return true;
527 if (scheme.length() == 5 && isASCIIAlphaCaselessEqual(scheme[4], 's'))
528 return true;
529 }
530
531 Locker<Lock> locker(schemeRegistryLock);
532 return serviceWorkerSchemes().contains(scheme);
533}
534
535bool SchemeRegistry::isServiceWorkerContainerCustomScheme(const String& scheme)
536{
537 Locker<Lock> locker(schemeRegistryLock);
538 return !scheme.isNull() && serviceWorkerSchemes().contains(scheme);
539}
540
541bool SchemeRegistry::isUserExtensionScheme(const String& scheme)
542{
543#if PLATFORM(MAC)
544 if (scheme == "safari-extension")
545 return true;
546#else
547 UNUSED_PARAM(scheme);
548#endif
549 return false;
550}
551
552bool SchemeRegistry::isBuiltinScheme(const String& scheme)
553{
554 return !scheme.isNull() && (allBuiltinSchemes().contains(scheme) || WTF::URLParser::isSpecialScheme(scheme));
555}
556
557} // namespace WebCore
558