1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
|
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this file,
* You can obtain one at http://mozilla.org/MPL/2.0/. */
#ifndef mozilla_contentblockingallowlist_h
#define mozilla_contentblockingallowlist_h
#include "mozilla/dom/BrowsingContext.h"
#include "nsIContentBlockingAllowList.h"
#include "nsIPermission.h"
#include "nsTHashSet.h"
class nsICookieJarSettings;
class nsIHttpChannel;
class nsIPrincipal;
class nsIURI;
class nsPIDOMWindowInner;
namespace mozilla {
class OriginAttributes;
/**
* @class ContentBlockingAllowListCache
*
* @brief This class represents a cache for the content blocking allow list. It
* is used for repeated lookups of the allow list for a specific base
* domain. Only use it if you need base domain lookups. In most cases
* this is not what you want. For regular allow-list checks by principal
* please use ContentBlockingAllowList.
*/
class ContentBlockingAllowListCache {
public:
/**
* @brief Checks if a given base domain is allow-listed. This method considers
* the domain to be allow list if either the base domain or any of its
* subdomains are allow-listed.
* This is different from regular allow-list checks,
* @see{ContentBlockingAllowList::Check} where allow-listed state is only
* inherited to subdomains if the base domain is allow-listed.
*
* Example:
* If "example.com" is allow-listed, then "www.example.com" is also
* considered allow-listed.
* If foobar.example.org is allow-listed, then "example.org" is not
* considered allow-listed.
*
* @param aBaseDomain The base domain to check.
* @param aOriginAttributes The origin attributes associated with the base
* domain.
* @param aIsAllowListed [out] Set to true if the base domain is allow-listed,
* false otherwise.
*
* @return NS_OK if the check is successful, or an error code otherwise.
*/
nsresult CheckForBaseDomain(const nsACString& aBaseDomain,
const OriginAttributes& aOriginAttributes,
bool& aIsAllowListed);
protected:
// The following methods may be overridden by subclasses for adding custom
// allow-list permissions.
/**
* @brief Returns the list of permission types that are used to check if a
* site is allow-listed.
*
* @return An array of permission types.
*/
virtual nsTArray<nsCString> GetAllowListPermissionTypes();
/**
* @brief Checks if a permission has an allow-list state by inspecting its
* fields e.g. capability. Permission type is not checked here, it is assumed
* that the permission type is one of the types returned by
* GetAllowListPermissionTypes.
*
* @param aPermission The permission to check.
* @param aResult [out] Set to true if the permission is an allow-list
* permission, false otherwise.
*
* @return NS_OK if the check is successful, or an error code otherwise.
*/
virtual nsresult IsAllowListPermission(nsIPermission* aPermission,
bool* aResult);
private:
bool mIsInitialized = false;
// The cache is a hash set of base domains. If a base domain is in the set, it
// is allow-listed for that context (normal browsing, private browsing.)
nsTHashSet<nsCString> mEntries;
nsTHashSet<nsCString> mEntriesPrivateBrowsing;
/**
* @brief Initializes the content blocking allow list cache if needed.
*
* @return NS_OK if initialization is successful, or an error code otherwise.
*/
nsresult EnsureInit();
};
class ContentBlockingAllowList final : public nsIContentBlockingAllowList {
public:
NS_DECL_ISUPPORTS
NS_DECL_NSICONTENTBLOCKINGALLOWLIST
// Check whether a principal is on the content blocking allow list.
// aPrincipal should be a "content blocking allow list principal".
// This principal can be obtained from the load info object for top-level
// windows.
static nsresult Check(nsIPrincipal* aContentBlockingAllowListPrincipal,
bool aIsPrivateBrowsing, bool& aIsAllowListed);
static bool Check(nsIHttpChannel* aChannel);
// Utility APIs for ContentBlocking.
static bool Check(nsPIDOMWindowInner* aWindow);
static bool Check(nsIPrincipal* aTopWinPrincipal, bool aIsPrivateBrowsing);
static bool Check(nsICookieJarSettings* aCookieJarSettings);
// Computes the principal used to check the content blocking allow list for a
// top-level document based on the document principal. This function is used
// right after setting up the document principal.
static void ComputePrincipal(nsIPrincipal* aDocumentPrincipal,
nsIPrincipal** aPrincipal);
static void RecomputePrincipal(nsIURI* aURIBeingLoaded,
const OriginAttributes& aAttrs,
nsIPrincipal** aPrincipal);
private:
~ContentBlockingAllowList() = default;
};
} // namespace mozilla
#endif // mozilla_contentblockingallowlist_h
|
