| // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| // Use of this source code is governed by a BSD-style license that can be |
| // found in the LICENSE file. |
| |
| #include <limits> |
| |
| #include "base/base64.h" |
| #include "base/strings/string_piece.h" |
| #include "base/strings/string_tokenizer.h" |
| #include "base/strings/string_util.h" |
| #include "net/base/parse_number.h" |
| #include "net/http/http_security_headers.h" |
| #include "net/http/http_util.h" |
| #include "url/gurl.h" |
| |
| namespace net { |
| |
| namespace { |
| |
| enum MaxAgeParsing { REQUIRE_MAX_AGE, DO_NOT_REQUIRE_MAX_AGE }; |
| |
| // MaxAgeToLimitedInt converts a string representation of a "whole number" of |
| // seconds into a uint32_t. The string may contain an arbitrarily large number, |
| // which will be clipped to a supplied limit and which is guaranteed to fit |
| // within a 32-bit unsigned integer. False is returned on any parse error. |
| bool MaxAgeToLimitedInt(std::string::const_iterator begin, |
| std::string::const_iterator end, |
| uint32_t limit, |
| uint32_t* result) { |
| const base::StringPiece s(begin, end); |
| |
| ParseIntError error; |
| if (!ParseUint32(s, result, &error)) { |
| if (error == ParseIntError::FAILED_OVERFLOW) { |
| *result = limit; |
| } else { |
| return false; |
| } |
| } |
| |
| if (*result > limit) |
| *result = limit; |
| |
| return true; |
| } |
| |
| } // namespace |
| |
| // Parse the Strict-Transport-Security header, as currently defined in |
| // http://tools.ietf.org/html/draft-ietf-websec-strict-transport-sec-14: |
| // |
| // Strict-Transport-Security = "Strict-Transport-Security" ":" |
| // [ directive ] *( ";" [ directive ] ) |
| // |
| // directive = directive-name [ "=" directive-value ] |
| // directive-name = token |
| // directive-value = token | quoted-string |
| // |
| // 1. The order of appearance of directives is not significant. |
| // |
| // 2. All directives MUST appear only once in an STS header field. |
| // Directives are either optional or required, as stipulated in |
| // their definitions. |
| // |
| // 3. Directive names are case-insensitive. |
| // |
| // 4. UAs MUST ignore any STS header fields containing directives, or |
| // other header field value data, that does not conform to the |
| // syntax defined in this specification. |
| // |
| // 5. If an STS header field contains directive(s) not recognized by |
| // the UA, the UA MUST ignore the unrecognized directives and if the |
| // STS header field otherwise satisfies the above requirements (1 |
| // through 4), the UA MUST process the recognized directives. |
| bool ParseHSTSHeader(const std::string& value, |
| base::TimeDelta* max_age, |
| bool* include_subdomains) { |
| uint32_t max_age_candidate = 0; |
| bool include_subdomains_candidate = false; |
| |
| // We must see max-age exactly once. |
| int max_age_observed = 0; |
| // We must see includeSubdomains exactly 0 or 1 times. |
| int include_subdomains_observed = 0; |
| |
| enum ParserState { |
| START, |
| AFTER_MAX_AGE_LABEL, |
| AFTER_MAX_AGE_EQUALS, |
| AFTER_MAX_AGE, |
| AFTER_INCLUDE_SUBDOMAINS, |
| AFTER_UNKNOWN_LABEL, |
| DIRECTIVE_END |
| } state = START; |
| |
| base::StringTokenizer tokenizer(value, " \t=;"); |
| tokenizer.set_options(base::StringTokenizer::RETURN_DELIMS); |
| tokenizer.set_quote_chars("\""); |
| std::string unquoted; |
| while (tokenizer.GetNext()) { |
| DCHECK(!tokenizer.token_is_delim() || tokenizer.token().length() == 1); |
| switch (state) { |
| case START: |
| case DIRECTIVE_END: |
| if (base::IsAsciiWhitespace(*tokenizer.token_begin())) |
| continue; |
| if (base::LowerCaseEqualsASCII(tokenizer.token(), "max-age")) { |
| state = AFTER_MAX_AGE_LABEL; |
| max_age_observed++; |
| } else if (base::LowerCaseEqualsASCII(tokenizer.token(), |
| "includesubdomains")) { |
| state = AFTER_INCLUDE_SUBDOMAINS; |
| include_subdomains_observed++; |
| include_subdomains_candidate = true; |
| } else { |
| state = AFTER_UNKNOWN_LABEL; |
| } |
| break; |
| |
| case AFTER_MAX_AGE_LABEL: |
| if (base::IsAsciiWhitespace(*tokenizer.token_begin())) |
| continue; |
| if (*tokenizer.token_begin() != '=') |
| return false; |
| DCHECK_EQ(tokenizer.token().length(), 1U); |
| state = AFTER_MAX_AGE_EQUALS; |
| break; |
| |
| case AFTER_MAX_AGE_EQUALS: |
| if (base::IsAsciiWhitespace(*tokenizer.token_begin())) |
| continue; |
| unquoted = HttpUtil::Unquote(tokenizer.token()); |
| if (!MaxAgeToLimitedInt(unquoted.begin(), unquoted.end(), |
| kMaxHSTSAgeSecs, &max_age_candidate)) |
| return false; |
| state = AFTER_MAX_AGE; |
| break; |
| |
| case AFTER_MAX_AGE: |
| case AFTER_INCLUDE_SUBDOMAINS: |
| if (base::IsAsciiWhitespace(*tokenizer.token_begin())) |
| continue; |
| else if (*tokenizer.token_begin() == ';') |
| state = DIRECTIVE_END; |
| else |
| return false; |
| break; |
| |
| case AFTER_UNKNOWN_LABEL: |
| // Consume and ignore the post-label contents (if any). |
| if (*tokenizer.token_begin() != ';') |
| continue; |
| state = DIRECTIVE_END; |
| break; |
| } |
| } |
| |
| // We've consumed all the input. Let's see what state we ended up in. |
| if (max_age_observed != 1 || |
| (include_subdomains_observed != 0 && include_subdomains_observed != 1)) { |
| return false; |
| } |
| |
| switch (state) { |
| case DIRECTIVE_END: |
| case AFTER_MAX_AGE: |
| case AFTER_INCLUDE_SUBDOMAINS: |
| case AFTER_UNKNOWN_LABEL: |
| *max_age = base::TimeDelta::FromSeconds(max_age_candidate); |
| *include_subdomains = include_subdomains_candidate; |
| return true; |
| case START: |
| case AFTER_MAX_AGE_LABEL: |
| case AFTER_MAX_AGE_EQUALS: |
| return false; |
| default: |
| NOTREACHED(); |
| return false; |
| } |
| } |
| |
| // "Expect-CT" ":" |
| // "max-age" "=" delta-seconds |
| // [ "," "enforce" ] |
| // [ "," "report-uri" "=" absolute-URI ] |
| bool ParseExpectCTHeader(const std::string& value, |
| base::TimeDelta* max_age, |
| bool* enforce, |
| GURL* report_uri) { |
| bool parsed_max_age = false; |
| bool enforce_candidate = false; |
| bool has_report_uri = false; |
| uint32_t max_age_candidate = 0; |
| GURL parsed_report_uri; |
| |
| HttpUtil::NameValuePairsIterator name_value_pairs( |
| value.begin(), value.end(), ',', |
| HttpUtil::NameValuePairsIterator::Values::NOT_REQUIRED, |
| // Use STRICT_QUOTES because "UAs must not attempt to fix malformed header |
| // fields." |
| HttpUtil::NameValuePairsIterator::Quotes::STRICT_QUOTES); |
| |
| while (name_value_pairs.GetNext()) { |
| base::StringPiece name(name_value_pairs.name_begin(), |
| name_value_pairs.name_end()); |
| if (base::LowerCaseEqualsASCII(name, "max-age")) { |
| // "A given directive MUST NOT appear more than once in a given header |
| // field." |
| if (parsed_max_age) |
| return false; |
| if (!MaxAgeToLimitedInt(name_value_pairs.value_begin(), |
| name_value_pairs.value_end(), kMaxExpectCTAgeSecs, |
| &max_age_candidate)) { |
| return false; |
| } |
| parsed_max_age = true; |
| } else if (base::LowerCaseEqualsASCII(name, "enforce")) { |
| // "A given directive MUST NOT appear more than once in a given header |
| // field." |
| if (enforce_candidate) |
| return false; |
| if (!name_value_pairs.value().empty()) |
| return false; |
| enforce_candidate = true; |
| } else if (base::LowerCaseEqualsASCII(name, "report-uri")) { |
| // "A given directive MUST NOT appear more than once in a given header |
| // field." |
| if (has_report_uri) |
| return false; |
| |
| has_report_uri = true; |
| parsed_report_uri = GURL(base::StringPiece(name_value_pairs.value_begin(), |
| name_value_pairs.value_end())); |
| if (parsed_report_uri.is_empty() || !parsed_report_uri.is_valid()) |
| return false; |
| } else { |
| // Silently ignore unknown directives for forward compatibility. |
| } |
| } |
| |
| if (!name_value_pairs.valid()) |
| return false; |
| |
| if (!parsed_max_age) |
| return false; |
| |
| *max_age = base::TimeDelta::FromSeconds(max_age_candidate); |
| *enforce = enforce_candidate; |
| *report_uri = parsed_report_uri; |
| return true; |
| } |
| |
| } // namespace net |