LibWeb: Remove OOM propagation from Fetch::Infrastructure::Requests

This commit is contained in:
Timothy Flynn 2024-04-26 13:35:10 -04:00 committed by Andreas Kling
commit 5a4f13dcd4
Notes: sideshowbarker 2024-07-17 02:28:18 +09:00
5 changed files with 24 additions and 28 deletions

View file

@ -12,7 +12,7 @@
namespace Web::Fetch::Fetching { namespace Web::Fetch::Fetching {
// https://fetch.spec.whatwg.org/#concept-cors-check // https://fetch.spec.whatwg.org/#concept-cors-check
ErrorOr<bool> cors_check(Infrastructure::Request const& request, Infrastructure::Response const& response) bool cors_check(Infrastructure::Request const& request, Infrastructure::Response const& response)
{ {
// 1. Let origin be the result of getting `Access-Control-Allow-Origin` from responses header list. // 1. Let origin be the result of getting `Access-Control-Allow-Origin` from responses header list.
auto origin = response.header_list()->get("Access-Control-Allow-Origin"sv.bytes()); auto origin = response.header_list()->get("Access-Control-Allow-Origin"sv.bytes());
@ -27,7 +27,7 @@ ErrorOr<bool> cors_check(Infrastructure::Request const& request, Infrastructure:
return true; return true;
// 4. If the result of byte-serializing a request origin with request is not origin, then return failure. // 4. If the result of byte-serializing a request origin with request is not origin, then return failure.
if (TRY(request.byte_serialize_origin()) != *origin) if (request.byte_serialize_origin() != *origin)
return false; return false;
// 5. If requests credentials mode is not "include", then return success. // 5. If requests credentials mode is not "include", then return success.
@ -46,7 +46,7 @@ ErrorOr<bool> cors_check(Infrastructure::Request const& request, Infrastructure:
} }
// https://fetch.spec.whatwg.org/#concept-tao-check // https://fetch.spec.whatwg.org/#concept-tao-check
ErrorOr<bool> tao_check(Infrastructure::Request const& request, Infrastructure::Response const& response) bool tao_check(Infrastructure::Request const& request, Infrastructure::Response const& response)
{ {
// 1. If requests timing allow failed flag is set, then return failure. // 1. If requests timing allow failed flag is set, then return failure.
if (request.timing_allow_failed()) if (request.timing_allow_failed())
@ -60,7 +60,7 @@ ErrorOr<bool> tao_check(Infrastructure::Request const& request, Infrastructure::
return true; return true;
// 4. If values contains the result of serializing a request origin with request, then return success. // 4. If values contains the result of serializing a request origin with request, then return success.
if (values.has_value() && values->contains_slow(TRY(request.serialize_origin()))) if (values.has_value() && values->contains_slow(request.serialize_origin()))
return true; return true;
// 5. If requests mode is "navigate" and requests current URLs origin is not same origin with requests origin, then return failure. // 5. If requests mode is "navigate" and requests current URLs origin is not same origin with requests origin, then return failure.

View file

@ -11,7 +11,7 @@
namespace Web::Fetch::Fetching { namespace Web::Fetch::Fetching {
ErrorOr<bool> cors_check(Infrastructure::Request const&, Infrastructure::Response const&); [[nodiscard]] bool cors_check(Infrastructure::Request const&, Infrastructure::Response const&);
ErrorOr<bool> tao_check(Infrastructure::Request const&, Infrastructure::Response const&); [[nodiscard]] bool tao_check(Infrastructure::Request const&, Infrastructure::Response const&);
} }

View file

@ -994,13 +994,13 @@ WebIDL::ExceptionOr<JS::NonnullGCPtr<PendingResponse>> http_fetch(JS::Realm& rea
// NOTE: As the CORS check is not to be applied to responses whose status is 304 or 407, or responses from // NOTE: As the CORS check is not to be applied to responses whose status is 304 or 407, or responses from
// a service worker for that matter, it is applied here. // a service worker for that matter, it is applied here.
if (request->response_tainting() == Infrastructure::Request::ResponseTainting::CORS if (request->response_tainting() == Infrastructure::Request::ResponseTainting::CORS
&& !TRY_OR_IGNORE(cors_check(request, *response))) { && !cors_check(request, *response)) {
returned_pending_response->resolve(Infrastructure::Response::network_error(vm, "Request with 'cors' response tainting failed CORS check"_string)); returned_pending_response->resolve(Infrastructure::Response::network_error(vm, "Request with 'cors' response tainting failed CORS check"_string));
return; return;
} }
// 5. If the TAO check for request and response returns failure, then set requests timing allow failed flag. // 5. If the TAO check for request and response returns failure, then set requests timing allow failed flag.
if (!TRY_OR_IGNORE(tao_check(request, *response))) if (!tao_check(request, *response))
request->set_timing_allow_failed(true); request->set_timing_allow_failed(true);
} }
@ -1353,7 +1353,7 @@ WebIDL::ExceptionOr<JS::NonnullGCPtr<PendingResponse>> http_network_or_cache_fet
} }
// 12. Append a request `Origin` header for httpRequest. // 12. Append a request `Origin` header for httpRequest.
TRY_OR_THROW_OOM(vm, http_request->add_origin_header()); http_request->add_origin_header();
// FIXME: 13. Append the Fetch metadata headers for httpRequest. // FIXME: 13. Append the Fetch metadata headers for httpRequest.
@ -1876,7 +1876,7 @@ WebIDL::ExceptionOr<JS::NonnullGCPtr<PendingResponse>> cors_preflight_fetch(JS::
// 7. If a CORS check for request and response returns success and responses status is an ok status, then: // 7. If a CORS check for request and response returns success and responses status is an ok status, then:
// NOTE: The CORS check is done on request rather than preflight to ensure the correct credentials mode is used. // NOTE: The CORS check is done on request rather than preflight to ensure the correct credentials mode is used.
if (TRY_OR_IGNORE(cors_check(request, response)) && Infrastructure::is_ok_status(response->status())) { if (cors_check(request, response) && Infrastructure::is_ok_status(response->status())) {
// 1. Let methods be the result of extracting header list values given `Access-Control-Allow-Methods` and responses header list. // 1. Let methods be the result of extracting header list values given `Access-Control-Allow-Methods` and responses header list.
auto methods_or_failure = Infrastructure::extract_header_list_values("Access-Control-Allow-Methods"sv.bytes(), response->header_list()); auto methods_or_failure = Infrastructure::extract_header_list_values("Access-Control-Allow-Methods"sv.bytes(), response->header_list());

View file

@ -186,21 +186,21 @@ bool Request::has_redirect_tainted_origin() const
} }
// https://fetch.spec.whatwg.org/#serializing-a-request-origin // https://fetch.spec.whatwg.org/#serializing-a-request-origin
ErrorOr<String> Request::serialize_origin() const String Request::serialize_origin() const
{ {
// 1. If request has a redirect-tainted origin, then return "null". // 1. If request has a redirect-tainted origin, then return "null".
if (has_redirect_tainted_origin()) if (has_redirect_tainted_origin())
return "null"_string; return "null"_string;
// 2. Return requests origin, serialized. // 2. Return requests origin, serialized.
return String::from_byte_string(m_origin.get<HTML::Origin>().serialize()); return MUST(String::from_byte_string(m_origin.get<HTML::Origin>().serialize()));
} }
// https://fetch.spec.whatwg.org/#byte-serializing-a-request-origin // https://fetch.spec.whatwg.org/#byte-serializing-a-request-origin
ErrorOr<ByteBuffer> Request::byte_serialize_origin() const ByteBuffer Request::byte_serialize_origin() const
{ {
// Byte-serializing a request origin, given a request request, is to return the result of serializing a request origin with request, isomorphic encoded. // Byte-serializing a request origin, given a request request, is to return the result of serializing a request origin with request, isomorphic encoded.
return ByteBuffer::copy(TRY(serialize_origin()).bytes()); return MUST(ByteBuffer::copy(serialize_origin().bytes()));
} }
// https://fetch.spec.whatwg.org/#concept-request-clone // https://fetch.spec.whatwg.org/#concept-request-clone
@ -259,7 +259,7 @@ JS::NonnullGCPtr<Request> Request::clone(JS::Realm& realm) const
} }
// https://fetch.spec.whatwg.org/#concept-request-add-range-header // https://fetch.spec.whatwg.org/#concept-request-add-range-header
ErrorOr<void> Request::add_range_header(u64 first, Optional<u64> const& last) void Request::add_range_header(u64 first, Optional<u64> const& last)
{ {
// To add a range header to a request request, with an integer first, and an optional integer last, run these steps: // To add a range header to a request request, with an integer first, and an optional integer last, run these steps:
@ -270,14 +270,14 @@ ErrorOr<void> Request::add_range_header(u64 first, Optional<u64> const& last)
auto range_value = MUST(ByteBuffer::copy("bytes"sv.bytes())); auto range_value = MUST(ByteBuffer::copy("bytes"sv.bytes()));
// 3. Serialize and isomorphic encode first, and append the result to rangeValue. // 3. Serialize and isomorphic encode first, and append the result to rangeValue.
TRY(range_value.try_append(TRY(String::number(first)).bytes())); range_value.append(MUST(String::number(first)).bytes());
// 4. Append 0x2D (-) to rangeValue. // 4. Append 0x2D (-) to rangeValue.
TRY(range_value.try_append('-')); range_value.append('-');
// 5. If last is given, then serialize and isomorphic encode it, and append the result to rangeValue. // 5. If last is given, then serialize and isomorphic encode it, and append the result to rangeValue.
if (last.has_value()) if (last.has_value())
TRY(range_value.try_append(TRY(String::number(*last)).bytes())); range_value.append(MUST(String::number(*last)).bytes());
// 6. Append (`Range`, rangeValue) to requests header list. // 6. Append (`Range`, rangeValue) to requests header list.
auto header = Header { auto header = Header {
@ -285,15 +285,13 @@ ErrorOr<void> Request::add_range_header(u64 first, Optional<u64> const& last)
.value = move(range_value), .value = move(range_value),
}; };
m_header_list->append(move(header)); m_header_list->append(move(header));
return {};
} }
// https://fetch.spec.whatwg.org/#append-a-request-origin-header // https://fetch.spec.whatwg.org/#append-a-request-origin-header
ErrorOr<void> Request::add_origin_header() void Request::add_origin_header()
{ {
// 1. Let serializedOrigin be the result of byte-serializing a request origin with request. // 1. Let serializedOrigin be the result of byte-serializing a request origin with request.
auto serialized_origin = TRY(byte_serialize_origin()); auto serialized_origin = byte_serialize_origin();
// 2. If requests response tainting is "cors" or requests mode is "websocket", then append (`Origin`, serializedOrigin) to requests header list. // 2. If requests response tainting is "cors" or requests mode is "websocket", then append (`Origin`, serializedOrigin) to requests header list.
if (m_response_tainting == ResponseTainting::CORS || m_mode == Mode::WebSocket) { if (m_response_tainting == ResponseTainting::CORS || m_mode == Mode::WebSocket) {
@ -345,8 +343,6 @@ ErrorOr<void> Request::add_origin_header()
}; };
m_header_list->append(move(header)); m_header_list->append(move(header));
} }
return {};
} }
// https://fetch.spec.whatwg.org/#cross-origin-embedder-policy-allows-credentials // https://fetch.spec.whatwg.org/#cross-origin-embedder-policy-allows-credentials

View file

@ -302,13 +302,13 @@ public:
[[nodiscard]] bool has_redirect_tainted_origin() const; [[nodiscard]] bool has_redirect_tainted_origin() const;
[[nodiscard]] ErrorOr<String> serialize_origin() const; [[nodiscard]] String serialize_origin() const;
[[nodiscard]] ErrorOr<ByteBuffer> byte_serialize_origin() const; [[nodiscard]] ByteBuffer byte_serialize_origin() const;
[[nodiscard]] JS::NonnullGCPtr<Request> clone(JS::Realm&) const; [[nodiscard]] JS::NonnullGCPtr<Request> clone(JS::Realm&) const;
[[nodiscard]] ErrorOr<void> add_range_header(u64 first, Optional<u64> const& last); void add_range_header(u64 first, Optional<u64> const& last);
[[nodiscard]] ErrorOr<void> add_origin_header(); void add_origin_header();
[[nodiscard]] bool cross_origin_embedder_policy_allows_credentials() const; [[nodiscard]] bool cross_origin_embedder_policy_allows_credentials() const;