url_canon_query.cc 6.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168
  1. // Copyright 2013 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "url/url_canon.h"
  5. #include "url/url_canon_internal.h"
  6. // Query canonicalization in IE
  7. // ----------------------------
  8. // IE is very permissive for query parameters specified in links on the page
  9. // (in contrast to links that it constructs itself based on form data). It does
  10. // not unescape any character. It does not reject any escape sequence (be they
  11. // invalid like "%2y" or freaky like %00).
  12. //
  13. // IE only escapes spaces and nothing else. Embedded NULLs, tabs (0x09),
  14. // LF (0x0a), and CR (0x0d) are removed (this probably happens at an earlier
  15. // layer since they are removed from all portions of the URL). All other
  16. // characters are passed unmodified. Invalid UTF-16 sequences are preserved as
  17. // well, with each character in the input being converted to UTF-8. It is the
  18. // server's job to make sense of this invalid query.
  19. //
  20. // Invalid multibyte sequences (for example, invalid UTF-8 on a UTF-8 page)
  21. // are converted to the invalid character and sent as unescaped UTF-8 (0xef,
  22. // 0xbf, 0xbd). This may not be canonicalization, the parser may generate these
  23. // strings before the URL handler ever sees them.
  24. //
  25. // Our query canonicalization
  26. // --------------------------
  27. // We escape all non-ASCII characters and control characters, like Firefox.
  28. // This is more conformant to the URL spec, and there do not seem to be many
  29. // problems relating to Firefox's behavior.
  30. //
  31. // Like IE, we will never unescape (although the application may want to try
  32. // unescaping to present the user with a more understandable URL). We will
  33. // replace all invalid sequences (including invalid UTF-16 sequences, which IE
  34. // doesn't) with the "invalid character," and we will escape it.
  35. namespace url {
  36. namespace {
  37. // Returns true if the characters starting at |begin| and going until |end|
  38. // (non-inclusive) are all representable in 7-bits.
  39. template<typename CHAR, typename UCHAR>
  40. bool IsAllASCII(const CHAR* spec, const Component& query) {
  41. int end = query.end();
  42. for (int i = query.begin; i < end; i++) {
  43. if (static_cast<UCHAR>(spec[i]) >= 0x80)
  44. return false;
  45. }
  46. return true;
  47. }
  48. // Appends the given string to the output, escaping characters that do not
  49. // match the given |type| in SharedCharTypes. This version will accept 8 or 16
  50. // bit characters, but assumes that they have only 7-bit values. It also assumes
  51. // that all UTF-8 values are correct, so doesn't bother checking
  52. template<typename CHAR>
  53. void AppendRaw8BitQueryString(const CHAR* source, int length,
  54. CanonOutput* output) {
  55. for (int i = 0; i < length; i++) {
  56. if (!IsQueryChar(static_cast<unsigned char>(source[i])))
  57. AppendEscapedChar(static_cast<unsigned char>(source[i]), output);
  58. else // Doesn't need escaping.
  59. output->push_back(static_cast<char>(source[i]));
  60. }
  61. }
  62. // Runs the converter on the given UTF-8 input. Since the converter expects
  63. // UTF-16, we have to convert first. The converter must be non-NULL.
  64. void RunConverter(const char* spec,
  65. const Component& query,
  66. CharsetConverter* converter,
  67. CanonOutput* output) {
  68. DCHECK(query.is_valid());
  69. // This function will replace any misencoded values with the invalid
  70. // character. This is what we want so we don't have to check for error.
  71. RawCanonOutputW<1024> utf16;
  72. ConvertUTF8ToUTF16(&spec[query.begin], static_cast<size_t>(query.len),
  73. &utf16);
  74. converter->ConvertFromUTF16(utf16.data(), utf16.length(), output);
  75. }
  76. // Runs the converter with the given UTF-16 input. We don't have to do
  77. // anything, but this overridden function allows us to use the same code
  78. // for both UTF-8 and UTF-16 input.
  79. void RunConverter(const char16_t* spec,
  80. const Component& query,
  81. CharsetConverter* converter,
  82. CanonOutput* output) {
  83. DCHECK(query.is_valid());
  84. converter->ConvertFromUTF16(&spec[query.begin],
  85. static_cast<size_t>(query.len), output);
  86. }
  87. template<typename CHAR, typename UCHAR>
  88. void DoConvertToQueryEncoding(const CHAR* spec,
  89. const Component& query,
  90. CharsetConverter* converter,
  91. CanonOutput* output) {
  92. if (IsAllASCII<CHAR, UCHAR>(spec, query)) {
  93. // Easy: the input can just appended with no character set conversions.
  94. AppendRaw8BitQueryString(&spec[query.begin], query.len, output);
  95. } else {
  96. // Harder: convert to the proper encoding first.
  97. if (converter) {
  98. // Run the converter to get an 8-bit string, then append it, escaping
  99. // necessary values.
  100. RawCanonOutput<1024> eight_bit;
  101. RunConverter(spec, query, converter, &eight_bit);
  102. AppendRaw8BitQueryString(eight_bit.data(), eight_bit.length(), output);
  103. } else {
  104. // No converter, do our own UTF-8 conversion.
  105. AppendStringOfType(&spec[query.begin], static_cast<size_t>(query.len),
  106. CHAR_QUERY, output);
  107. }
  108. }
  109. }
  110. template<typename CHAR, typename UCHAR>
  111. void DoCanonicalizeQuery(const CHAR* spec,
  112. const Component& query,
  113. CharsetConverter* converter,
  114. CanonOutput* output,
  115. Component* out_query) {
  116. if (query.len < 0) {
  117. *out_query = Component();
  118. return;
  119. }
  120. output->push_back('?');
  121. out_query->begin = output->length();
  122. DoConvertToQueryEncoding<CHAR, UCHAR>(spec, query, converter, output);
  123. out_query->len = output->length() - out_query->begin;
  124. }
  125. } // namespace
  126. void CanonicalizeQuery(const char* spec,
  127. const Component& query,
  128. CharsetConverter* converter,
  129. CanonOutput* output,
  130. Component* out_query) {
  131. DoCanonicalizeQuery<char, unsigned char>(spec, query, converter,
  132. output, out_query);
  133. }
  134. void CanonicalizeQuery(const char16_t* spec,
  135. const Component& query,
  136. CharsetConverter* converter,
  137. CanonOutput* output,
  138. Component* out_query) {
  139. DoCanonicalizeQuery<char16_t, char16_t>(spec, query, converter, output,
  140. out_query);
  141. }
  142. void ConvertUTF16ToQueryEncoding(const char16_t* input,
  143. const Component& query,
  144. CharsetConverter* converter,
  145. CanonOutput* output) {
  146. DoConvertToQueryEncoding<char16_t, char16_t>(input, query, converter, output);
  147. }
  148. } // namespace url