mirrors/ladybird
0
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2025-05-31 07:22:50 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

LibWeb: Partition Blob URL fetches by Storage Key

Browse source 
This was a security mechanism introduced in the fetch spec, with
supporting AOs added to the FileAPI spec.
This commit is contained in:
Shannon Booth 2025-01-19 19:02:18 +13:00 • committed by Tim Ledbetter
parent 70df8122b1
commit 00cef330ef
Notes: github-actions[bot] 2025-01-21 19:23:08 +00:00
6 changed files with 146 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

38
Libraries/LibWeb/FileAPI/BlobURLStore.cpp
View file

@ -1,7 +1,7 @@
/*
* Copyright (c) 2023, Tim Flynn <trflynn89@serenityos.org>
* Copyright (c) 2024, Andreas Kling <andreas@ladybird.org>
* Copyright (c) 2024, Shannon Booth <shannon@serenityos.org>
* Copyright (c) 2024-2025, Shannon Booth <shannon@serenityos.org>
*
* SPDX-License-Identifier: BSD-2-Clause
*/
@ -14,6 +14,7 @@
#include <LibWeb/FileAPI/Blob.h>
#include <LibWeb/FileAPI/BlobURLStore.h>
#include <LibWeb/HTML/Scripting/Environments.h>
#include <LibWeb/StorageAPI/StorageKey.h>
namespace Web::FileAPI {
@ -78,6 +79,41 @@ ErrorOr<String> add_entry_to_blob_url_store(GC::Ref<Blob> object)
return url;
}
// https://www.w3.org/TR/FileAPI/#check-for-same-partition-blob-url-usage
bool check_for_same_partition_blob_url_usage(URL::BlobURLEntry const& blob_url_entry, GC::Ref<HTML::Environment> environment)
{
// 1. Let blobStorageKey be the result of obtaining a storage key for non-storage purposes with blobUrlEntry’s environment.
auto blob_storage_key = StorageAPI::obtain_a_storage_key_for_non_storage_purposes(blob_url_entry.environment.origin);
// 2. Let environmentStorageKey be the result of obtaining a storage key for non-storage purposes with environment.
auto environment_storage_key = StorageAPI::obtain_a_storage_key_for_non_storage_purposes(environment);
// 3. If blobStorageKey is not equal to environmentStorageKey, then return false.
if (blob_storage_key != environment_storage_key)
return false;
// 4. Return true.
return true;
}
// https://www.w3.org/TR/FileAPI/#blob-url-obtain-object
Optional<URL::BlobURLEntry::Object> obtain_a_blob_object(URL::BlobURLEntry const& blob_url_entry, Variant<GC::Ref<HTML::Environment>, NavigationEnvironment> environment)
{
// 1. Let isAuthorized be true.
bool is_authorized = true;
// 2. If environment is not the string "navigation", then set isAuthorized to the result of checking for same-partition blob URL usage with blobUrlEntry and environment.
if (!environment.has<NavigationEnvironment>())
is_authorized = check_for_same_partition_blob_url_usage(blob_url_entry, environment.get<GC::Ref<HTML::Environment>>());
// 3. If isAuthorized is false, then return failure.
if (!is_authorized)
return {};
// 4. Return blobUrlEntry’s object.
return blob_url_entry.object;
}
// https://w3c.github.io/FileAPI/#removeTheEntry
void remove_entry_from_blob_url_store(StringView url)
{