third_party/WebKit/Source/platform/weborigin/SchemeRegistry.h

   1 /*
   2  * Copyright (C) 2010 Apple Inc. All Rights Reserved.
   3  *
   4  * Redistribution and use in source and binary forms, with or without
   5  * modification, are permitted provided that the following conditions
   6  * are met:
   7  * 1. Redistributions of source code must retain the above copyright
   8  *    notice, this list of conditions and the following disclaimer.
   9  * 2. Redistributions in binary form must reproduce the above copyright
  10  *    notice, this list of conditions and the following disclaimer in the
  11  *    documentation and/or other materials provided with the distribution.
  12  *
  13  * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
  14  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  15  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  16  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
  17  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  18  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  19  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  20  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  21  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  23  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  24  *
  25  */
  26
  27 #ifndef SchemeRegistry_h
  28 #define SchemeRegistry_h
  29
  30 #include "platform/PlatformExport.h"
  31 #include "wtf/HashMap.h"
  32 #include "wtf/HashSet.h"
  33 #include "wtf/text/StringHash.h"
  34 #include "wtf/text/WTFString.h"
  35
  36 namespace blink {
  37
  38 using URLSchemesSet = HashSet<String, CaseFoldingHash>;
  39
  40 template <typename T>
  41 using URLSchemesMap = HashMap<String, T, CaseFoldingHash>;
  42
  43 class PLATFORM_EXPORT SchemeRegistry {
  44 public:
  45     static void registerURLSchemeAsLocal(const String&);
  46     static bool shouldTreatURLSchemeAsLocal(const String&);
  47
  48     static void registerURLSchemeAsRestrictingMixedContent(const String&);
  49     static bool shouldTreatURLSchemeAsRestrictingMixedContent(const String&);
  50
  51     // Subresources transported by secure schemes do not trigger mixed content
  52     // warnings. For example, https and data are secure schemes because they
  53     // cannot be corrupted by active network attackers.
  54     static void registerURLSchemeAsSecure(const String&);
  55     static bool shouldTreatURLSchemeAsSecure(const String&);
  56
  57     static void registerURLSchemeAsNoAccess(const String&);
  58     static bool shouldTreatURLSchemeAsNoAccess(const String&);
  59
  60     // Display-isolated schemes can only be displayed (in the sense of
  61     // SecurityOrigin::canDisplay) by documents from the same scheme.
  62     static void registerURLSchemeAsDisplayIsolated(const String&);
  63     static bool shouldTreatURLSchemeAsDisplayIsolated(const String&);
  64
  65     static void registerURLSchemeAsEmptyDocument(const String&);
  66     static bool shouldLoadURLSchemeAsEmptyDocument(const String&);
  67
  68     static void setDomainRelaxationForbiddenForURLScheme(bool forbidden, const String&);
  69     static bool isDomainRelaxationForbiddenForURLScheme(const String&);
  70
  71     // Such schemes should delegate to SecurityOrigin::canRequest for any URL
  72     // passed to SecurityOrigin::canDisplay.
  73     static bool canDisplayOnlyIfCanRequest(const String& scheme);
  74
  75     // Schemes against which javascript: URLs should not be allowed to run (stop
  76     // bookmarklets from running on sensitive pages).
  77     static void registerURLSchemeAsNotAllowingJavascriptURLs(const String& scheme);
  78     static bool shouldTreatURLSchemeAsNotAllowingJavascriptURLs(const String& scheme);
  79
  80     // Allow non-HTTP schemes to be registered to allow CORS requests.
  81     static void registerURLSchemeAsCORSEnabled(const String& scheme);
  82     static bool shouldTreatURLSchemeAsCORSEnabled(const String& scheme);
  83
  84     // Serialize the registered schemes in a comma-separated list.
  85     static String listOfCORSEnabledURLSchemes();
  86
  87     // "Legacy" schemes (e.g. 'ftp:', 'gopher:') which we might want to treat differently from "webby" schemes.
  88     static bool shouldTreatURLSchemeAsLegacy(const String& scheme);
  89
  90     // Schemes that can register a service worker.
  91     static void registerURLSchemeAsAllowingServiceWorkers(const String& scheme);
  92     static bool shouldTreatURLSchemeAsAllowingServiceWorkers(const String& scheme);
  93
  94     // HTTP-like schemes that are treated as supporting the Fetch API.
  95     static void registerURLSchemeAsSupportingFetchAPI(const String& scheme);
  96     static bool shouldTreatURLSchemeAsSupportingFetchAPI(const String& scheme);
  97
  98     // Schemes which override the first-/third-party checks on a Document.
  99     static void registerURLSchemeAsFirstPartyWhenTopLevel(const String& scheme);
 100     static bool shouldTreatURLSchemeAsFirstPartyWhenTopLevel(const String& scheme);
 101
 102     // Allow resources from some schemes to load on a page, regardless of its
 103     // Content Security Policy.
 104     // This enum should be kept in sync with public/web/WebSecurityPolicy.h.
 105     // Enforced in AssertMatchingEnums.cpp.
 106     enum PolicyAreas : uint32_t {
 107         PolicyAreaNone = 0,
 108         PolicyAreaImage = 1 << 0,
 109         PolicyAreaStyle = 1 << 1,
 110         // Add more policy areas as needed by clients.
 111         PolicyAreaAll = ~static_cast<uint32_t>(0),
 112     };
 113     static void registerURLSchemeAsBypassingContentSecurityPolicy(const String& scheme, PolicyAreas = PolicyAreaAll);
 114     static void removeURLSchemeRegisteredAsBypassingContentSecurityPolicy(const String& scheme);
 115     static bool schemeShouldBypassContentSecurityPolicy(const String& scheme, PolicyAreas = PolicyAreaAll);
 116
 117 private:
 118     static const URLSchemesSet& localSchemes();
 119 };
 120
 121 } // namespace blink
 122
 123 #endif // SchemeRegistry_h