1/*
2    Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
3
4    This library is free software; you can redistribute it and/or
5    modify it under the terms of the GNU Library General Public
6    License as published by the Free Software Foundation; either
7    version 2 of the License, or (at your option) any later version.
8
9    This library is distributed in the hope that it will be useful,
10    but WITHOUT ANY WARRANTY; without even the implied warranty of
11    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
12    Library General Public License for more details.
13
14    You should have received a copy of the GNU Library General Public License
15    along with this library; see the file COPYING.LIB.  If not, write to
16    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
17    Boston, MA 02110-1301, USA.
18*/
19
20#include "config.h"
21#include "qwebsecurityorigin.h"
22
23#include "ApplicationCacheStorage.h"
24#include "DatabaseTracker.h"
25#include "KURL.h"
26#include "SchemeRegistry.h"
27#include "SecurityOrigin.h"
28#include "qwebdatabase.h"
29#include "qwebdatabase_p.h"
30#include "qwebsecurityorigin_p.h"
31#include <QStringList>
32
33using namespace WebCore;
34
35/*!
36    \class QWebSecurityOrigin
37    \since 4.5
38    \brief The QWebSecurityOrigin class defines a security boundary for web sites.
39
40    \inmodule QtWebKit
41
42    QWebSecurityOrigin provides access to the security domains defined by web sites.
43    An origin consists of a host name, a scheme, and a port number. Web sites
44    with the same security origin can access each other's resources for client-side
45    scripting or databases.
46
47    For example the site \c{http://www.example.com/my/page.html} is allowed to share the same
48    database as \c{http://www.example.com/my/overview.html}, or access each other's
49    documents when used in HTML frame sets and JavaScript. At the same time it prevents
50    \c{http://www.malicious.com/evil.html} from accessing \c{http://www.example.com/}'s resources,
51    because they are of a different security origin.
52
53    By default local schemes like \c{file://} and \c{qrc://} are concidered to be in the same
54    security origin, and can access each other's resources. You can add additional local schemes
55    by using QWebSecurityOrigin::addLocalScheme(), or override the default same-origin behavior
56    by setting QWebSettings::LocalContentCanAccessFileUrls to \c{false}.
57
58    \note Local resources are by default restricted from accessing remote content, which
59    means your \c{file://} will not be able to access \c{http://domain.com/foo.html}. You
60    can relax this restriction by setting QWebSettings::LocalContentCanAccessRemoteUrls to
61    \c{true}.
62
63    Call QWebFrame::securityOrigin() to get the QWebSecurityOrigin for a frame in a
64    web page, and use host(), scheme() and port() to identify the security origin.
65
66    Use databases() to access the databases defined within a security origin. The
67    disk usage of the origin's databases can be limited with setDatabaseQuota().
68    databaseQuota() and databaseUsage() report the current limit as well as the
69    current usage.
70
71    For more information refer to the
72    \l{http://en.wikipedia.org/wiki/Same_origin_policy}{"Same origin policy" Wikipedia Article}.
73
74    \sa QWebFrame::securityOrigin()
75*/
76
77/*!
78    Constructs a security origin from \a other.
79*/
80QWebSecurityOrigin::QWebSecurityOrigin(const QWebSecurityOrigin& other) : d(other.d)
81{
82}
83
84/*!
85    Assigns the \a other security origin to this.
86*/
87QWebSecurityOrigin& QWebSecurityOrigin::operator=(const QWebSecurityOrigin& other)
88{
89    d = other.d;
90    return *this;
91}
92
93/*!
94    Returns the scheme defining the security origin.
95*/
96QString QWebSecurityOrigin::scheme() const
97{
98    return d->origin->protocol();
99}
100
101/*!
102    Returns the host name defining the security origin.
103*/
104QString QWebSecurityOrigin::host() const
105{
106    return d->origin->host();
107}
108
109/*!
110    Returns the port number defining the security origin.
111*/
112int QWebSecurityOrigin::port() const
113{
114    return d->origin->port();
115}
116
117/*!
118    Returns the number of bytes all databases in the security origin
119    use on the disk.
120*/
121qint64 QWebSecurityOrigin::databaseUsage() const
122{
123#if ENABLE(DATABASE)
124    return DatabaseTracker::tracker().usageForOrigin(d->origin.get());
125#else
126    return 0;
127#endif
128}
129
130/*!
131    Returns the quota for the databases in the security origin.
132*/
133qint64 QWebSecurityOrigin::databaseQuota() const
134{
135#if ENABLE(DATABASE)
136    return DatabaseTracker::tracker().quotaForOrigin(d->origin.get());
137#else
138    return 0;
139#endif
140}
141
142/*!
143    Sets the quota for the databases in the security origin to \a quota bytes.
144
145    If the quota is set to a value less than the current usage, the quota will remain
146    and no data will be purged to meet the new quota. However, no new data can be added
147    to databases in this origin.
148*/
149void QWebSecurityOrigin::setDatabaseQuota(qint64 quota)
150{
151#if ENABLE(DATABASE)
152    DatabaseTracker::tracker().setQuota(d->origin.get(), quota);
153#endif
154}
155
156void QWebSecurityOrigin::setApplicationCacheQuota(qint64 quota)
157{
158#if ENABLE(OFFLINE_WEB_APPLICATIONS)
159    WebCore::cacheStorage().storeUpdatedQuotaForOrigin(d->origin.get(), quota);
160#endif
161}
162/*!
163    Destroys the security origin.
164*/
165QWebSecurityOrigin::~QWebSecurityOrigin()
166{
167}
168
169/*!
170    \internal
171*/
172QWebSecurityOrigin::QWebSecurityOrigin(QWebSecurityOriginPrivate* priv)
173{
174    d = priv;
175}
176
177/*!
178    Returns a list of all security origins with a database quota defined.
179*/
180QList<QWebSecurityOrigin> QWebSecurityOrigin::allOrigins()
181{
182    QList<QWebSecurityOrigin> webOrigins;
183
184#if ENABLE(DATABASE)
185    Vector<RefPtr<SecurityOrigin> > coreOrigins;
186    DatabaseTracker::tracker().origins(coreOrigins);
187
188    for (unsigned i = 0; i < coreOrigins.size(); ++i) {
189        QWebSecurityOriginPrivate* priv = new QWebSecurityOriginPrivate(coreOrigins[i].get());
190        webOrigins.append(priv);
191    }
192#endif
193
194    return webOrigins;
195}
196
197/*!
198    Returns a list of all databases defined in the security origin.
199*/
200QList<QWebDatabase> QWebSecurityOrigin::databases() const
201{
202    QList<QWebDatabase> databases;
203
204#if ENABLE(DATABASE)
205    Vector<String> nameVector;
206
207    if (!DatabaseTracker::tracker().databaseNamesForOrigin(d->origin.get(), nameVector))
208        return databases;
209    for (unsigned i = 0; i < nameVector.size(); ++i) {
210        QWebDatabasePrivate* priv = new QWebDatabasePrivate();
211        priv->name = nameVector[i];
212        priv->origin = this->d->origin;
213        QWebDatabase webDatabase(priv);
214        databases.append(webDatabase);
215    }
216#endif
217
218    return databases;
219}
220
221/*!
222    \since 4.6
223
224    Adds the given \a scheme to the list of schemes that are considered equivalent
225    to the \c file: scheme.
226
227    Cross domain restrictions depend on the two web settings QWebSettings::LocalContentCanAccessFileUrls
228    and QWebSettings::LocalContentCanAccessFileUrls. By default all local schemes are concidered to be
229    in the same security origin, and local schemes can not access remote content.
230*/
231void QWebSecurityOrigin::addLocalScheme(const QString& scheme)
232{
233    SchemeRegistry::registerURLSchemeAsLocal(scheme);
234}
235
236/*!
237    \since 4.6
238
239    Removes the given \a scheme from the list of local schemes.
240
241    \note You can not remove the \c{file://} scheme from the list
242    of local schemes.
243
244    \sa addLocalScheme()
245*/
246void QWebSecurityOrigin::removeLocalScheme(const QString& scheme)
247{
248    SchemeRegistry::removeURLSchemeRegisteredAsLocal(scheme);
249}
250
251/*!
252    \since 4.6
253    Returns a list of all the schemes concidered to be local.
254
255    By default this is \c{file://} and \c{qrc://}.
256
257    \sa addLocalScheme(), removeLocalScheme()
258*/
259QStringList QWebSecurityOrigin::localSchemes()
260{
261    QStringList list;
262    const URLSchemesMap& map = SchemeRegistry::localSchemes();
263    URLSchemesMap::const_iterator end = map.end();
264    for (URLSchemesMap::const_iterator i = map.begin(); i != end; ++i) {
265        const QString scheme = *i;
266        list.append(scheme);
267    }
268    return list;
269}
270