1 /*

     2  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)

     3  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)

     4  *  Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.

     5  *

     6  *  This library is free software; you can redistribute it and/or

     7  *  modify it under the terms of the GNU Lesser General Public

     8  *  License as published by the Free Software Foundation; either

     9  *  version 2 of the License, or (at your option) any later version.

    10  *

    11  *  This library is distributed in the hope that it will be useful,

    12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of

    13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

    14  *  Lesser General Public License for more details.

    15  *

    16  *  You should have received a copy of the GNU Lesser General Public

    17  *  License along with this library; if not, write to the Free Software

    18  *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA

    19  */

    20 

    21 #include "config.h"

    22 #include "ScriptController.h"

    23 

    24 #include "Frame.h"

    25 #include "FrameLoaderClient.h"

    26 #include "Page.h"

    27 #include "ScriptSourceCode.h"

    28 #include "ScriptValue.h"

    29 #include "Settings.h"

    30 #include "XSSAuditor.h"

    31 

    32 namespace WebCore {

    33 

    34 bool ScriptController::canExecuteScripts(ReasonForCallingCanExecuteScripts reason)

    35 {

    36     // FIXME: We should get this information from the document instead of the frame.

    37     if (m_frame->loader()->isSandboxed(SandboxScripts))

    38         return false;

    39 

    40     Settings* settings = m_frame->settings();

    41     const bool allowed = m_frame->loader()->client()->allowJavaScript(settings && settings->isJavaScriptEnabled());

    42     if (!allowed && reason == AboutToExecuteScript)

    43         m_frame->loader()->client()->didNotAllowScript();

    44     return allowed;

    45 }

    46 

    47 ScriptValue ScriptController::executeScript(const String& script, bool forceUserGesture, ShouldAllowXSS shouldAllowXSS)

    48 {

    49     return executeScript(ScriptSourceCode(script, forceUserGesture ? KURL() : m_frame->loader()->url()), shouldAllowXSS);

    50 }

    51 

    52 ScriptValue ScriptController::executeScript(const ScriptSourceCode& sourceCode, ShouldAllowXSS shouldAllowXSS)

    53 {

    54     if (!canExecuteScripts(AboutToExecuteScript) || isPaused())

    55         return ScriptValue();

    56 

    57     bool wasInExecuteScript = m_inExecuteScript;

    58     m_inExecuteScript = true;

    59 

    60     ScriptValue result = evaluate(sourceCode, shouldAllowXSS);

    61 

    62     if (!wasInExecuteScript) {

    63         m_inExecuteScript = false;

    64         Document::updateStyleForAllDocuments();

    65     }

    66 

    67     return result;

    68 }

    69 

    70 bool ScriptController::executeIfJavaScriptURL(const KURL& url, bool userGesture, ShouldReplaceDocumentIfJavaScriptURL shouldReplaceDocumentIfJavaScriptURL)

    71 {

    72     if (!protocolIsJavaScript(url))

    73         return false;

    74 

    75     if (m_frame->page() && !m_frame->page()->javaScriptURLsAreAllowed())

    76         return true;

    77 

    78     if (m_frame->inViewSourceMode())

    79         return true;

    80 

    81     const int javascriptSchemeLength = sizeof("javascript:") - 1;

    82 

    83     String decodedURL = decodeURLEscapeSequences(url.string());

    84     ScriptValue result;

    85     if (xssAuditor()->canEvaluateJavaScriptURL(decodedURL))

    86         result = executeScript(decodedURL.substring(javascriptSchemeLength), userGesture, AllowXSS);

    87 

    88     String scriptResult;

    89 #if USE(JSC)

    90     JSDOMWindowShell* shell = windowShell(mainThreadNormalWorld());

    91     JSC::ExecState* exec = shell->window()->globalExec();

    92     if (!result.getString(exec, scriptResult))

    93         return true;

    94 #else

    95     if (!result.getString(scriptResult))

    96         return true;

    97 #endif

    98 

    99     // FIXME: We should always replace the document, but doing so

   100     //        synchronously can cause crashes:

   101     //        http://bugs.webkit.org/show_bug.cgi?id=16782

   102     if (shouldReplaceDocumentIfJavaScriptURL == ReplaceDocumentIfJavaScriptURL)

   103         m_frame->loader()->writer()->replaceDocument(scriptResult);

   104 

   105     return true;

   106 }

   107 

   108 } // namespace WebCore