ladybird/Libraries/LibWeb/PermissionsPolicy/AutoplayAllowlist.cpp
Shannon Booth d62cf0a807 Everywhere: Remove some use of the URL constructors
These make it too easy to construct an invalid URL, which makes it
difficult to remove the valid state of URL - which this API relies
on.
2025-02-19 08:01:35 -05:00

92 lines
2.9 KiB
C++
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

/*
* Copyright (c) 2023, Tim Flynn <trflynn89@serenityos.org>
*
* SPDX-License-Identifier: BSD-2-Clause
*/
#include <AK/String.h>
#include <LibURL/Origin.h>
#include <LibURL/Parser.h>
#include <LibURL/URL.h>
#include <LibWeb/DOM/Document.h>
#include <LibWeb/DOMURL/DOMURL.h>
#include <LibWeb/PermissionsPolicy/AutoplayAllowlist.h>
// FIXME: This is an ad-hoc implementation of the "autoplay" policy-controlled feature:
// https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature
namespace Web::PermissionsPolicy {
AutoplayAllowlist& AutoplayAllowlist::the()
{
static AutoplayAllowlist filter;
return filter;
}
AutoplayAllowlist::AutoplayAllowlist() = default;
AutoplayAllowlist::~AutoplayAllowlist() = default;
// https://w3c.github.io/webappsec-permissions-policy/#is-feature-enabled
Decision AutoplayAllowlist::is_allowed_for_origin(DOM::Document const& document, URL::Origin const& origin) const
{
// FIXME: 1. Let policy be documents Permissions Policy
// FIXME: 2. If policys inherited policy for feature is Disabled, return "Disabled".
// 3. If feature is present in policys declared policy:
if (m_allowlist.has_value()) {
// 1. If the allowlist for feature in policys declared policy matches origin, then return "Enabled".
// 2. Otherwise return "Disabled".
return m_allowlist->visit(
[](Global) {
return Decision::Enabled;
},
[&](auto const& patterns) {
for (auto const& pattern : patterns) {
if (pattern.is_same_origin_domain(origin))
return Decision::Enabled;
}
return Decision::Disabled;
});
}
// 4. If features default allowlist is *, return "Enabled".
// 5. If features default allowlist is 'self', and origin is same origin with documents origin, return "Enabled".
// NOTE: The "autoplay" feature's default allowlist is 'self'.
// https://html.spec.whatwg.org/multipage/infrastructure.html#autoplay-feature
if (origin.is_same_origin(document.origin()))
return Decision::Enabled;
// 6. Return "Disabled".
return Decision::Disabled;
}
void AutoplayAllowlist::enable_globally()
{
m_allowlist = Global {};
}
ErrorOr<void> AutoplayAllowlist::enable_for_origins(ReadonlySpan<String> origins)
{
m_allowlist = Patterns {};
auto& allowlist = m_allowlist->get<Patterns>();
TRY(allowlist.try_ensure_capacity(origins.size()));
for (auto const& origin : origins) {
auto url = URL::Parser::basic_parse(origin);
if (!url.has_value())
url = URL::Parser::basic_parse(TRY(String::formatted("https://{}", origin)));
if (!url.has_value()) {
dbgln("Invalid origin for autoplay allowlist: {}", origin);
continue;
}
TRY(allowlist.try_append(url->origin()));
}
return {};
}
}