LibWeb: Support the X-Frame-Options header

Navigation responses are now checked for adherence to the
`X-Frame-Options` header and an error is shown accordingly.

Libraries/LibWeb/HTML/NavigationParams.cpp

@@ -4,6 +4,7 @@
  * SPDX-License-Identifier: BSD-2-Clause
  */
 
+#include <LibWeb/DOM/Document.h>
 #include <LibWeb/Fetch/Infrastructure/FetchController.h>
 #include <LibWeb/HTML/Navigable.h>
 #include <LibWeb/HTML/NavigationParams.h>
@@ -30,4 +31,67 @@ void NonFetchSchemeNavigationParams::visit_edges(Visitor& visitor)
     visitor.visit(navigable);
 }
 
+// https://html.spec.whatwg.org/multipage/document-lifecycle.html#check-a-navigation-response's-adherence-to-x-frame-options
+// FIXME: Add the cspList parameter
+bool check_a_navigation_responses_adherence_to_x_frame_options(GC::Ptr<Fetch::Infrastructure::Response> response, Navigable* navigable, URL::Origin destination_origin)
+{
+    // 1. If navigable is not a child navigable, then return true.
+    if (!navigable->parent()) {
+        return true;
+    }
+
+    // FIXME: 2. For each policy of cspList:
+    //          1. If policy's disposition is not "enforce", then continue.
+    //          2. If policy's directive set contains a frame-ancestors directive, then return true.
+
+    // 3. Let rawXFrameOptions be the result of getting, decoding, and splitting `X-Frame-Options` from response's header list.
+    auto raw_x_frame_options = response->header_list()->get_decode_and_split("X-Frame-Options"sv.bytes());
+
+    // 4. Let xFrameOptions be a new set.
+    auto x_frame_options = AK::OrderedHashTable<String>();
+
+    // 5. For each value of rawXFrameOptions, append value, converted to ASCII lowercase, to xFrameOptions.
+    if (raw_x_frame_options.has_value()) {
+        for (auto const& value : raw_x_frame_options.value()) {
+            x_frame_options.set(value.to_ascii_lowercase());
+        }
+    }
+
+    // 6. If xFrameOptions's size is greater than 1, and xFrameOptions contains any of "deny", "allowall", or "sameorigin", then return false.
+    if (x_frame_options.size() > 1 && (x_frame_options.contains("deny"sv) || x_frame_options.contains("allowall"sv) || x_frame_options.contains("sameorigin"sv))) {
+        return false;
+    }
+
+    // 7. If xFrameOptions's size is greater than 1, then return true.
+    if (x_frame_options.size() > 1) {
+        return true;
+    }
+
+    // 8. If xFrameOptions[0] is "deny", then return false.
+    auto first_x_frame_option = x_frame_options.begin();
+    if (!x_frame_options.is_empty() && *first_x_frame_option == "deny"sv) {
+        return false;
+    }
+
+    // 9. If xFrameOptions[0] is "sameorigin", then:
+    if (!x_frame_options.is_empty() && *first_x_frame_option == "sameorigin"sv) {
+        // 1. Let containerDocument be navigable's container document.
+        auto container_document = navigable->container_document();
+
+        // 2. While containerDocument is not null:
+        while (container_document) {
+            // 1. If containerDocument's origin is not same origin with destinationOrigin, then return false.
+            if (!container_document->origin().is_same_origin(destination_origin)) {
+                return false;
+            }
+
+            // 2. Set containerDocument to containerDocument's container document.
+            container_document = container_document->container_document();
+        }
+    }
+
+    // 10. Return true.
+    return true;
+}
+
 }