/*

    Copyright (C) 1997 Martin Jones (mjones@kde.org)

              (C) 1997 Torben Weis (weis@kde.org)

              (C) 1998 Waldo Bastian (bastian@kde.org)

              (C) 1999 Lars Knoll (knoll@kde.org)

              (C) 1999 Antti Koivisto (koivisto@kde.org)

              (C) 2001 Dirk Mueller (mueller@kde.org)

    Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.

    Copyright (C) 2005, 2006 Alexey Proskuryakov (ap@nypop.com)

    Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)

    This library is free software; you can redistribute it and/or

    modify it under the terms of the GNU Library General Public

    License as published by the Free Software Foundation; either

    version 2 of the License, or (at your option) any later version.

    This library is distributed in the hope that it will be useful,

    but WITHOUT ANY WARRANTY; without even the implied warranty of

    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

    Library General Public License for more details.

    You should have received a copy of the GNU Library General Public License

    along with this library; see the file COPYING.LIB.  If not, write to

    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,

    Boston, MA 02110-1301, USA.

*/

#include "config.h"

#include "LegacyHTMLDocumentParser.h"

#include "Attribute.h"

#include "CSSHelper.h"

#include "Cache.h"

#include "CachedScript.h"

#include "DocLoader.h"

#include "DocumentFragment.h"

#include "Event.h"

#include "EventNames.h"

#include "Frame.h"

#include "FrameLoader.h"

#include "FrameView.h"

#include "HTMLElement.h"

#include "HTMLNames.h"

#include "LegacyHTMLTreeBuilder.h"

#include "HTMLScriptElement.h"

#include "HTMLViewSourceDocument.h"

#include "ImageLoader.h"

#include "InspectorTimelineAgent.h"

#include "Page.h"

#include "LegacyPreloadScanner.h"

#include "ScriptSourceCode.h"

#include "ScriptValue.h"

#include "XSSAuditor.h"

#include <wtf/ASCIICType.h>

#include <wtf/CurrentTime.h>

#include "HTMLEntityNames.cpp"

#define PRELOAD_SCANNER_ENABLED 1

using namespace WTF;

using namespace std;

namespace WebCore {

using namespace HTMLNames;

// This value is used to define how many loops (approximately tokens)

// the parser will make before checking if it should yield.

// To increase responsiveness reduce both ChunkSize and TimeDelay contants.

static const int defaultTokenizerChunkSize = 4096;

// FIXME: We would like this constant to be 200ms.

// Yielding more aggressively results in increased responsiveness and better incremental rendering.

// It slows down overall page-load on slower machines, though, so for now we set a value of 500.

// TimeDelay controls the maximum time the parser will run before yielding.

// Inline script execution can cause the parser to excede this limit.

static const double defaultTokenizerTimeDelay = 0.500;

static const char commentStart [] = "<!--";

static const char doctypeStart [] = "<!doctype";

static const char publicStart [] = "public";

static const char systemStart [] = "system";

static const char scriptEnd [] = "</script";

static const char xmpEnd [] = "</xmp";

static const char styleEnd [] =  "</style";

static const char textareaEnd [] = "</textarea";

static const char titleEnd [] = "</title";

static const char iframeEnd [] = "</iframe";

// Full support for MS Windows extensions to Latin-1.

// Technically these extensions should only be activated for pages

// marked "windows-1252" or "cp1252", but

// in the standard Microsoft way, these extensions infect hundreds of thousands

// of web pages.  Note that people with non-latin-1 Microsoft extensions

// are SOL.

//

// See: http://www.microsoft.com/globaldev/reference/WinCP.asp

//      http://www.bbsinc.com/iso8859.html

//      http://www.obviously.com/

//

// There may be better equivalents

// We only need this for entities. For non-entity text, we handle this in the text encoding.

static const UChar windowsLatin1ExtensionArray[32] = {

    0x20AC, 0x0081, 0x201A, 0x0192, 0x201E, 0x2026, 0x2020, 0x2021, // 80-87

    0x02C6, 0x2030, 0x0160, 0x2039, 0x0152, 0x008D, 0x017D, 0x008F, // 88-8F

    0x0090, 0x2018, 0x2019, 0x201C, 0x201D, 0x2022, 0x2013, 0x2014, // 90-97

    0x02DC, 0x2122, 0x0161, 0x203A, 0x0153, 0x009D, 0x017E, 0x0178  // 98-9F

};

static inline UChar fixUpChar(UChar c)

{

    if ((c & ~0x1F) != 0x0080)

        return c;

    return windowsLatin1ExtensionArray[c - 0x80];

}

static inline bool tagMatch(const char* s1, const UChar* s2, unsigned length)

{

    for (unsigned i = 0; i != length; ++i) {

        unsigned char c1 = s1[i];

        unsigned char uc1 = toASCIIUpper(static_cast<char>(c1));

        UChar c2 = s2[i];

        if (c1 != c2 && uc1 != c2)

            return false;

    }

    return true;

}

inline void Token::addAttribute(AtomicString& attrName, const AtomicString& attributeValue, bool viewSourceMode)

{

    if (!attrName.isEmpty()) {

        ASSERT(!attrName.contains('/'));

        RefPtr<Attribute> a = Attribute::createMapped(attrName, attributeValue);

        if (!attrs) {

            attrs = NamedNodeMap::create();

            attrs->reserveInitialCapacity(10);

        }

        attrs->insertAttribute(a.release(), viewSourceMode);

    }

    attrName = emptyAtom;

}

// ----------------------------------------------------------------------------

LegacyHTMLDocumentParser::LegacyHTMLDocumentParser(HTMLDocument* document, bool reportErrors)

    : ScriptableDocumentParser(document)

    , m_buffer(0)

    , m_scriptCode(0)

    , m_scriptCodeSize(0)

    , m_scriptCodeCapacity(0)

    , m_scriptCodeResync(0)

    , m_executingScript(0)

    , m_requestingScript(false)

    , m_hasScriptsWaitingForStylesheets(false)

    , m_timer(this, &LegacyHTMLDocumentParser::timerFired)

    , m_externalScriptsTimer(this, &LegacyHTMLDocumentParser::executeExternalScriptsTimerFired)

    , m_treeBuilder(new LegacyHTMLTreeBuilder(document, reportErrors))

    , m_inWrite(false)

    , m_fragment(false)

    , m_scriptingPermission(FragmentScriptingAllowed)

{

    begin();

}

LegacyHTMLDocumentParser::LegacyHTMLDocumentParser(HTMLViewSourceDocument* document)

    : ScriptableDocumentParser(document, true)

    , m_buffer(0)

    , m_scriptCode(0)

    , m_scriptCodeSize(0)

    , m_scriptCodeCapacity(0)

    , m_scriptCodeResync(0)

    , m_executingScript(0)

    , m_requestingScript(false)

    , m_hasScriptsWaitingForStylesheets(false)

    , m_timer(this, &LegacyHTMLDocumentParser::timerFired)

    , m_externalScriptsTimer(this, &LegacyHTMLDocumentParser::executeExternalScriptsTimerFired)

    , m_inWrite(false)

    , m_fragment(false)

    , m_scriptingPermission(FragmentScriptingAllowed)

{

    begin();

}

LegacyHTMLDocumentParser::LegacyHTMLDocumentParser(DocumentFragment* frag, FragmentScriptingPermission scriptingPermission)

    : ScriptableDocumentParser(frag->document())

    , m_buffer(0)

    , m_scriptCode(0)

    , m_scriptCodeSize(0)

    , m_scriptCodeCapacity(0)

    , m_scriptCodeResync(0)

    , m_executingScript(0)

    , m_requestingScript(false)

    , m_hasScriptsWaitingForStylesheets(false)

    , m_timer(this, &LegacyHTMLDocumentParser::timerFired)

    , m_externalScriptsTimer(this, &LegacyHTMLDocumentParser::executeExternalScriptsTimerFired)

    , m_treeBuilder(new LegacyHTMLTreeBuilder(frag, scriptingPermission))

    , m_inWrite(false)

    , m_fragment(true)

    , m_scriptingPermission(scriptingPermission)

{

    begin();

}

void LegacyHTMLDocumentParser::reset()

{

    ASSERT(m_executingScript == 0);

    while (!m_pendingScripts.isEmpty()) {

        CachedResourceHandle<CachedScript> cs = m_pendingScripts.takeFirst();

        ASSERT(cache()->disabled() || cs->accessCount() > 0);

        cs->removeClient(this);

    }

    fastFree(m_buffer);

    m_buffer = m_dest = 0;

    m_bufferSize = 0;

    fastFree(m_scriptCode);

    m_scriptCode = 0;

    m_scriptCodeSize = m_scriptCodeCapacity = m_scriptCodeResync = 0;

    m_timer.stop();

    m_externalScriptsTimer.stop();

    m_state.setAllowYield(false);

    m_state.setForceSynchronous(false);

    m_currentToken.reset();

    m_doctypeToken.reset();

    m_doctypeSearchCount = 0;

    m_doctypeSecondarySearchCount = 0;

    m_hasScriptsWaitingForStylesheets = false;

}

void LegacyHTMLDocumentParser::begin()

{

    m_executingScript = 0;

    m_requestingScript = false;

    m_hasScriptsWaitingForStylesheets = false;

    m_state.setLoadingExtScript(false);

    reset();

    m_bufferSize = 254;

    m_buffer = static_cast<UChar*>(fastMalloc(sizeof(UChar) * 254));

    m_dest = m_buffer;

    tquote = NoQuote;

    searchCount = 0;

    m_state.setEntityState(NoEntity);

    m_scriptTagSrcAttrValue = String();

    m_pendingSrc.clear();

    m_currentPrependingSrc = 0;

    m_noMoreData = false;

    m_brokenComments = false;

    m_brokenServer = false;

    m_lineNumber = 0;

    m_currentScriptTagStartLineNumber = 0;

    m_currentTagStartLineNumber = 0;

    m_state.setForceSynchronous(false);

    Page* page = document()->page();

    if (page && page->hasCustomHTMLTokenizerTimeDelay())

        m_tokenizerTimeDelay = page->customHTMLTokenizerTimeDelay();

    else

        m_tokenizerTimeDelay = defaultTokenizerTimeDelay;

    if (page && page->hasCustomHTMLTokenizerChunkSize())

        m_tokenizerChunkSize = page->customHTMLTokenizerChunkSize();

    else

        m_tokenizerChunkSize = defaultTokenizerChunkSize;

}

void LegacyHTMLDocumentParser::setForceSynchronous(bool force)

{

    m_state.setForceSynchronous(force);

}

LegacyHTMLDocumentParser::State LegacyHTMLDocumentParser::processListing(SegmentedString list, State state)

{

    // This function adds the listing 'list' as

    // preformatted text-tokens to the token-collection

    while (!list.isEmpty()) {

        if (state.skipLF()) {

            state.setSkipLF(false);

            if (*list == '\n') {

                list.advance();

                continue;

            }

        }

        checkBuffer();

        if (*list == '\n' || *list == '\r') {

            if (state.discardLF())

                // Ignore this LF

                state.setDiscardLF(false); // We have discarded 1 LF

            else

                *m_dest++ = '\n';

            /* Check for MS-DOS CRLF sequence */

            if (*list == '\r')

                state.setSkipLF(true);

            list.advance();

        } else {

            state.setDiscardLF(false);

            *m_dest++ = *list;

            list.advance();

        }

    }

    return state;

}

LegacyHTMLDocumentParser::State LegacyHTMLDocumentParser::parseNonHTMLText(SegmentedString& src, State state)

{

    ASSERT(state.inTextArea() || state.inTitle() || state.inIFrame() || !state.hasEntityState());

    ASSERT(!state.hasTagState());

    ASSERT(state.inXmp() + state.inTextArea() + state.inTitle() + state.inStyle() + state.inScript() + state.inIFrame() == 1);

    if (state.inScript() && !m_currentScriptTagStartLineNumber)

        m_currentScriptTagStartLineNumber = m_lineNumber;

    if (state.inComment())

        state = parseComment(src, state);

    int lastDecodedEntityPosition = -1;

    while (!src.isEmpty()) {

        checkScriptBuffer();

        UChar ch = *src;

        if (!m_scriptCodeResync && !m_brokenComments &&

            !state.inXmp() && ch == '-' && m_scriptCodeSize >= 3 && !src.escaped() &&

            m_scriptCode[m_scriptCodeSize - 3] == '<' && m_scriptCode[m_scriptCodeSize - 2] == '!' && m_scriptCode[m_scriptCodeSize - 1] == '-' &&

            (lastDecodedEntityPosition < m_scriptCodeSize - 3)) {

            state.setInComment(true);

            state = parseComment(src, state);

            continue;

        }

        if (m_scriptCodeResync && !tquote && ch == '>') {

            src.advancePastNonNewline();

            m_scriptCodeSize = m_scriptCodeResync - 1;

            m_scriptCodeResync = 0;

            m_scriptCode[m_scriptCodeSize] = m_scriptCode[m_scriptCodeSize + 1] = 0;

            if (state.inScript())

                state = scriptHandler(state);

            else {

                state = processListing(SegmentedString(m_scriptCode, m_scriptCodeSize), state);

                processToken();

                if (state.inStyle()) {

                    m_currentToken.tagName = styleTag.localName();

                    m_currentToken.beginTag = false;

                } else if (state.inTextArea()) {

                    m_currentToken.tagName = textareaTag.localName();

                    m_currentToken.beginTag = false;

                } else if (state.inTitle()) {

                    m_currentToken.tagName = titleTag.localName();

                    m_currentToken.beginTag = false;

                } else if (state.inXmp()) {

                    m_currentToken.tagName = xmpTag.localName();

                    m_currentToken.beginTag = false;

                } else if (state.inIFrame()) {

                    m_currentToken.tagName = iframeTag.localName();

                    m_currentToken.beginTag = false;

                }

                processToken();

                state.setInStyle(false);

                state.setInScript(false);

                state.setInTextArea(false);

                state.setInTitle(false);

                state.setInXmp(false);

                state.setInIFrame(false);

                tquote = NoQuote;

                m_scriptCodeSize = m_scriptCodeResync = 0;

            }

            return state;

        }

        // possible end of tagname, lets check.

        if (!m_scriptCodeResync && !state.escaped() && !src.escaped() && (ch == '>' || ch == '/' || isASCIISpace(ch)) &&

             m_scriptCodeSize >= m_searchStopperLength &&

             tagMatch(m_searchStopper, m_scriptCode + m_scriptCodeSize - m_searchStopperLength, m_searchStopperLength) &&

             (lastDecodedEntityPosition < m_scriptCodeSize - m_searchStopperLength)) {

            m_scriptCodeResync = m_scriptCodeSize-m_searchStopperLength+1;

            tquote = NoQuote;

            continue;

        }

        if (m_scriptCodeResync && !state.escaped()) {

            if (ch == '\"')

                tquote = (tquote == NoQuote) ? DoubleQuote : ((tquote == SingleQuote) ? SingleQuote : NoQuote);

            else if (ch == '\'')

                tquote = (tquote == NoQuote) ? SingleQuote : (tquote == DoubleQuote) ? DoubleQuote : NoQuote;

            else if (tquote != NoQuote && (ch == '\r' || ch == '\n'))

                tquote = NoQuote;

        }

        state.setEscaped(!state.escaped() && ch == '\\');

        if (!m_scriptCodeResync && (state.inTextArea() || state.inTitle() || state.inIFrame()) && !src.escaped() && ch == '&') {

            UChar* scriptCodeDest = m_scriptCode + m_scriptCodeSize;

            src.advancePastNonNewline();

            state = parseEntity(src, scriptCodeDest, state, m_cBufferPos, true, false);

            if (scriptCodeDest == m_scriptCode + m_scriptCodeSize)

                lastDecodedEntityPosition = m_scriptCodeSize;

            else

                m_scriptCodeSize = scriptCodeDest - m_scriptCode;

        } else {

            m_scriptCode[m_scriptCodeSize++] = ch;

            src.advance(m_lineNumber);

        }

    }

    return state;

}

LegacyHTMLDocumentParser::State LegacyHTMLDocumentParser::scriptHandler(State state)

{

    // We are inside a <script>

    bool doScriptExec = false;

    int startLine = m_currentScriptTagStartLineNumber + 1; // Script line numbers are 1 based, HTMLTokenzier line numbers are 0 based

    // Reset m_currentScriptTagStartLineNumber to indicate that we've finished parsing the current script element

    m_currentScriptTagStartLineNumber = 0;

    // (Bugzilla 3837) Scripts following a frameset element should not execute or,

    // in the case of extern scripts, even load.

    bool followingFrameset = (document()->body() && document()->body()->hasTagName(framesetTag));

    CachedScript* cs = 0;

    // don't load external scripts for standalone documents (for now)

    if (!inViewSourceMode()) {

        if (!m_scriptTagSrcAttrValue.isEmpty() && document()->frame()) {

            // forget what we just got; load from src url instead

            if (!m_treeBuilder->skipMode() && !followingFrameset) {

                // The parser might have been stopped by for example a window.close call in an earlier script.

                // If so, we don't want to load scripts.

                if (!m_parserStopped && m_scriptNode->dispatchBeforeLoadEvent(m_scriptTagSrcAttrValue) &&

                    (cs = document()->docLoader()->requestScript(m_scriptTagSrcAttrValue, m_scriptTagCharsetAttrValue)))

                    m_pendingScripts.append(cs);

                else

                    m_scriptNode = 0;

            } else

                m_scriptNode = 0;

            m_scriptTagSrcAttrValue = String();

        } else {

            // Parse m_scriptCode containing <script> info

            doScriptExec = m_scriptNode->shouldExecuteAsJavaScript();

#if ENABLE(XHTMLMP)

            if (!doScriptExec)

                document()->setShouldProcessNoscriptElement(true);

#endif

            m_scriptNode = 0;

        }

    }

    state = processListing(SegmentedString(m_scriptCode, m_scriptCodeSize), state);

    RefPtr<Node> node = processToken();

    if (node && m_scriptingPermission == FragmentScriptingNotAllowed) {

        ExceptionCode ec;

        node->remove(ec);

        node = 0;

    }

    String scriptString = node ? node->textContent() : "";

    m_currentToken.tagName = scriptTag.localName();

    m_currentToken.beginTag = false;

    processToken();

    state.setInScript(false);

    m_scriptCodeSize = m_scriptCodeResync = 0;

    // FIXME: The script should be syntax highlighted.

    if (inViewSourceMode())

        return state;

    SegmentedString* savedPrependingSrc = m_currentPrependingSrc;

    SegmentedString prependingSrc;

    m_currentPrependingSrc = &prependingSrc;

    if (!m_treeBuilder->skipMode() && !followingFrameset) {

        if (cs) {

            if (savedPrependingSrc)

                savedPrependingSrc->append(m_src);

            else

                m_pendingSrc.prepend(m_src);

            setSrc(SegmentedString());

            // the ref() call below may call notifyFinished if the script is already in cache,

            // and that mucks with the state directly, so we must write it back to the object.

            m_state = state;

            bool savedRequestingScript = m_requestingScript;

            m_requestingScript = true;

            cs->addClient(this);

            m_requestingScript = savedRequestingScript;

            state = m_state;

            // will be 0 if script was already loaded and ref() executed it

            if (!m_pendingScripts.isEmpty())

                state.setLoadingExtScript(true);

        } else if (!m_fragment && doScriptExec) {

            if (!m_executingScript)

                m_pendingSrc.prepend(m_src);

            else

                prependingSrc = m_src;

            setSrc(SegmentedString());

            state = scriptExecution(ScriptSourceCode(scriptString, document()->frame() ? document()->frame()->document()->url() : KURL(), startLine), state);

        }

    }

    if (!m_executingScript && !state.loadingExtScript()) {

        m_src.append(m_pendingSrc);

        m_pendingSrc.clear();

    } else if (!prependingSrc.isEmpty()) {

        // restore first so that the write appends in the right place

        // (does not hurt to do it again below)

        m_currentPrependingSrc = savedPrependingSrc;

        // we need to do this slightly modified bit of one of the write() cases

        // because we want to prepend to m_pendingSrc rather than appending

        // if there's no previous prependingSrc

        if (!m_pendingScripts.isEmpty()) {

            if (m_currentPrependingSrc)

                m_currentPrependingSrc->append(prependingSrc);

            else

                m_pendingSrc.prepend(prependingSrc);

        } else {

            m_state = state;

            write(prependingSrc, false);

            state = m_state;

        }