Commit graph

29 commits

Author SHA1 Message Date
Luke Wilde
7643a079c0 LibWeb: Enforce Content Security Policy of Fetch responses 2025-03-19 00:55:14 +01:00
Luke Wilde
51796e2d3a LibWeb: Report CSP violations for request 2025-03-19 00:55:14 +01:00
Luke Wilde
6f771f45e2 LibWeb: Enforce Content Security Policy on Fetch requests 2025-03-19 00:55:14 +01:00
Luke Wilde
6d1f78198d LibWeb: Implement Resource Timing 2025-03-06 09:00:53 -07:00
Luke Wilde
23c84e62a5 LibWeb/Fetch: Update timing info with the timings received from RS 2025-03-06 09:00:53 -07:00
Luke Wilde
618697ef13 LibWeb: Make reference to global in report timing steps non-const
Marking a resource timing entry requires calling non-const methods on
the global object to append to the performance buffer.
2025-03-06 09:00:53 -07:00
Luke Wilde
209b10e53e RequestServer: Retrieve timing info from curl and pipe it to LibWeb
This timing info will be used to create a PerformanceResourceTiming
entry.
2025-03-06 09:00:53 -07:00
Luke Wilde
cae0ab2139 LibWeb: Make PolicyContainer GC allocated
This is required to store Content Security Policies, as their
Directives are implemented as subclasses with overridden virtual
functions. Thus, they cannot be stored as generic Directive classes, as
it'll lose the ability to call overridden functions when they are
copied.
2025-02-21 12:43:48 +00:00
Luke Wilde
b35979c3f7 LibWeb: Set Sec-Fetch-Site header to same-site where appropriate
This also fixes it looking at the request's current URL origin instead
of the request's actual origin.
2025-01-30 19:32:57 +01:00
Shannon Booth
00cef330ef LibWeb: Partition Blob URL fetches by Storage Key
This was a security mechanism introduced in the fetch spec, with
supporting AOs added to the FileAPI spec.
2025-01-21 19:22:07 +00:00
Shannon Booth
ca3d9d9ee0 LibURL+LibWeb+LibIPC: Represent blob URL entry's object using structs
Instead of just putting in members directly, wrap them up in structs
which represent what a URL blob entry is meant to hold per the spec.
This makes more obvious what this is meant to represent, such as the
ByteBuffer being used to represent the bytes behind a Blob.

This also allows us to use a stronger type for a function that needs
to return a Blob URL entry's object.
2025-01-21 19:22:07 +00:00
Shannon Booth
ffda698d3a LibWeb/Streams: Actually implement the piped through steps
This mistakenly implemented the 'piped to' operation on ReadableStream.
No functional difference as the caller was doing the extra work already
of 'piped through' vs 'piped to'.
2024-12-27 06:56:38 -08:00
Andreas Kling
3bfb0534be LibGC: Rename MarkedVector => RootVector
Let's try to make it a bit more clear that this is a Vector of GC roots.
2024-12-26 19:10:44 +01:00
Shannon Booth
3913e9f948 LibWeb/Fetch: Return a cloned cached response body
Otherwise we will fully read from the cached response and invalidate
it's stream, invalidating it for the next time it is read from. Fixes
a crash when reloading linegoup.lol after two reloads.
2024-12-26 13:44:52 +01:00
Andreas Kling
56e6d4f42d LibWeb: Protect HTTP cache entries from garbage collector
One day we'll have an eviction strategy, too, but for now let's not
allow these to get collected.

Co-Authored-By: Gingeh <39150378+Gingeh@users.noreply.github.com>
2024-12-25 17:11:16 +01:00
Shannon Booth
da408cb09a LibWeb: Add a 'piped through' helper method on ReadableStream
This reads a bit nicer, and follows the streams spec pattern on
performing operations on a stream outside of the streams spec.
2024-12-25 12:00:54 +01:00
Feng Yu
e0c0668f3d LibWeb: Avoid re-encoding response headers
isomorphic encoding a value that has already been encoded will
result in garbage data. `response_headers` is already encoded in
ISO-8859-1/latin1, we cannot use `from_string_pair`, as it triggers
ISO-8859-1/latin1 encoding.

Follow-up of https://github.com/LadybirdBrowser/ladybird/pull/1893
2024-12-17 13:44:10 +01:00
Shannon Booth
19bbfb023a LibWeb/Streams: Move "set up transform stream" to TransformStream
This is not marked as an AO in the spec, and is a publically exported
API exposed on TransformStream.
2024-12-11 15:11:21 +01:00
Shannon Booth
3f572d9ab7 LibWeb/Streams: Move ReadableStream functions out of AbstractOperations
These are not defined in the abstract operations section of the spec and
are the publically exported Stream APIs exposed on ReadableStream.
2024-12-11 15:11:21 +01:00
Timothy Flynn
953fe75271 LibWeb: Remove exception handling from safely extracting response bodies
The entire purpose of this AO is to avoid handling exceptions, which we
can do now that the underlying AOs do not throw exceptions on OOM.
2024-12-09 20:02:51 -07:00
Timothy Flynn
49ff5eb4d8 LibWeb: Do not move heap functions into other heap functions in Fetch
In particular, the processBody callback here *can't* move the
processBodyError callback. It is needed a few lines after. Passing by
value is safe and intended here.
2024-12-09 20:02:51 -07:00
Sam Atkins
63688148b9 LibURL: Promote Host to a proper class
This lets us move a few Host-related functions (like serialization and
checks for what the Host is) into Host instead of having them dotted
around the codebase.

For now, the interface is still very Variant-like, to avoid having to
change quite so much in one go.
2024-11-30 12:07:39 +01:00
Sam Atkins
90e763de4c LibURL: Replace Host's Empty state with making Url's Host optional
A couple of reasons:
- Origin's Host (when in the tuple state) can't be null
- There's an "empty host" concept in the spec which is NOT the same as a
  null Host, and that was confusing me.
2024-11-30 12:07:39 +01:00
Shannon Booth
fb17f8ff66 LibWeb: Get document for cookies usage from principal realm
Needed for when a shadow realm does an HTTP fetch as part of an import.
2024-11-30 11:55:11 +01:00
Shannon Booth
4913dac745 LibWeb: Get Page from principal realm during resource loading
Fixes a crash for module loading for a shadow realm.
2024-11-24 15:29:47 -07:00
rmg-x
13f349aea2 LibWeb/Fetch: Implement blob range section of scheme fetch specification 2024-11-21 00:26:58 +00:00
Shannon Booth
f87041bf3a LibGC+Everywhere: Factor out a LibGC from LibJS
Resulting in a massive rename across almost everywhere! Alongside the
namespace change, we now have the following names:

 * JS::NonnullGCPtr -> GC::Ref
 * JS::GCPtr -> GC::Ptr
 * JS::HeapFunction -> GC::Function
 * JS::CellImpl -> GC::Cell
 * JS::Handle -> GC::Root
2024-11-15 14:49:20 +01:00
Shannon Booth
9b79a686eb LibJS+LibWeb: Use realm.create<T> instead of heap.allocate<T>
The main motivation behind this is to remove JS specifics of the Realm
from the implementation of the Heap.

As a side effect of this change, this is a bit nicer to read than the
previous approach, and in my opinion, also makes it a little more clear
that this method is specific to a JavaScript Realm.
2024-11-13 16:51:44 -05:00
Timothy Flynn
93712b24bf Everywhere: Hoist the Libraries folder to the top-level 2024-11-10 12:50:45 +01:00
Renamed from Userland/Libraries/LibWeb/Fetch/Fetching/Fetching.cpp (Browse further)