content_security_policy/
sandboxing_directive.rs

1use bitflags::bitflags;
2#[cfg(feature = "serde")]
3use serde::{Deserialize, Serialize};
4
5bitflags! {
6    #[derive(Clone, Copy, Debug, PartialEq, Eq)]
7    #[cfg_attr(feature = "serde", derive(Deserialize, Serialize))]
8    pub struct SandboxingFlagSet: u32 {
9        const SANDBOXED_NAVIGATION_BROWSING_CONTEXT_FLAG = 0x00000001;
10        const SANDBOXED_AUXILIARY_NAVIGATION_BROWSING_CONTEXT_FLAG = 0x00000002;
11        const SANDBOXED_TOP_LEVEL_NAVIGATION_WITHOUT_USER_ACTIVATION_BROWSING_CONTEXT_FLAG
12            = 0x00000004;
13        const SANDBOXED_TOP_LEVEL_NAVIGATION_WITH_USER_ACTIVATION_BROWSING_CONTEXT_FLAG
14            = 0x00000008;
15        const SANDBOXED_PLUGINS_BROWSING_CONTEXT_FLAG = 0x00000010;
16        const SANDBOXED_ORIGIN_BROWSING_CONTEXT_FLAG = 0x00000020;
17        const SANDBOXED_FORMS_BROWSING_CONTEXT_FLAG = 0x00000040;
18        const SANDBOXED_POINTER_LOCK_BROWSING_CONTEXT_FLAG = 0x00000080;
19        const SANDBOXED_SCRIPTS_BROWSING_CONTEXT_FLAG = 0x00000100;
20        const SANDBOXED_AUTOMATIC_FEATURES_BROWSING_CONTEXT_FLAG = 0x00000200;
21        const SANDBOXED_STORAGE_AREA_URLS_FLAG = 0x00000400;
22        const SANDBOXED_DOCUMENT_DOMAIN_BROWSING_CONTEXT_FLAG = 0x00000800;
23        const SANDBOX_PROPOGATES_TO_AUXILIARY_BROWSING_CONTEXTS_FLAG = 0x00001000;
24        const SANDBOXED_MODALS_FLAG = 0x00002000;
25        const SANDBOXED_ORIENTATION_LOCK_BROWSING_CONTEXT_FLAG = 0x00004000;
26        const SANDBOXED_PRESENTATION_BROWSING_CONTEXT_FLAG = 0x00008000;
27        const SANDBOXED_DOWNLOADS_BROWSING_CONTEXT_FLAG = 0x0010000;
28        const SANBOXED_CUSTOM_PROTOCOLS_NAVIGATION_BROWSING_CONTEXT_FLAG = 0x0020000;
29    }
30}
31
32/// <https://html.spec.whatwg.org/multipage/#parse-a-sandboxing-directive>
33pub fn parse_a_sandboxing_directive(tokens: &[String]) -> SandboxingFlagSet {
34    // Step 1. Split input on ASCII whitespace, to obtain tokens.
35    //
36    // Performed by callers
37    // Step 2. Let output be empty.
38    //
39    // We inverse the logic here where we add all and then remove when required.
40    // This is why we don't need to explicitly add some flags, separate from the
41    // specification
42    let mut output = SandboxingFlagSet::all();
43    // Step 3. Add the following flags to output:
44    for token in tokens {
45        let remove = match &token[..] {
46            // The sandboxed auxiliary navigation browsing context flag, unless tokens contains the allow-popups keyword.
47            "allow-popups" =>
48                SandboxingFlagSet::SANDBOXED_AUXILIARY_NAVIGATION_BROWSING_CONTEXT_FLAG |
49                SandboxingFlagSet::SANBOXED_CUSTOM_PROTOCOLS_NAVIGATION_BROWSING_CONTEXT_FLAG,
50            // The sandboxed top-level navigation without user activation browsing context flag, unless tokens contains the allow-top-navigation keyword.
51            "allow-top-navigation" =>
52                SandboxingFlagSet::SANDBOXED_TOP_LEVEL_NAVIGATION_WITHOUT_USER_ACTIVATION_BROWSING_CONTEXT_FLAG |
53                    SandboxingFlagSet::SANDBOXED_TOP_LEVEL_NAVIGATION_WITH_USER_ACTIVATION_BROWSING_CONTEXT_FLAG |
54                    SandboxingFlagSet::SANBOXED_CUSTOM_PROTOCOLS_NAVIGATION_BROWSING_CONTEXT_FLAG,
55            // The sandboxed top-level navigation with user activation browsing context flag, unless tokens contains either
56            // the allow-top-navigation-by-user-activation keyword or the allow-top-navigation keyword.
57            "allow-top-navigation-by-user-activation" =>
58                SandboxingFlagSet::SANDBOXED_TOP_LEVEL_NAVIGATION_WITH_USER_ACTIVATION_BROWSING_CONTEXT_FLAG,
59            // The sandboxed origin browsing context flag, unless the tokens contains the allow-same-origin keyword.
60            "allow-same-origin" =>
61                SandboxingFlagSet::SANDBOXED_ORIGIN_BROWSING_CONTEXT_FLAG,
62            // The sandboxed forms browsing context flag, unless tokens contains the allow-forms keyword.
63            "allow-forms" =>
64                SandboxingFlagSet::SANDBOXED_FORMS_BROWSING_CONTEXT_FLAG,
65            // The sandboxed pointer lock browsing context flag, unless tokens contains the allow-pointer-lock keyword.
66            "allow-pointer-lock" =>
67                SandboxingFlagSet::SANDBOXED_POINTER_LOCK_BROWSING_CONTEXT_FLAG,
68            // The sandboxed scripts browsing context flag, unless tokens contains the allow-scripts keyword.
69            // The sandboxed automatic features browsing context flag, unless tokens contains the allow-scripts keyword (defined above).
70            "allow-scripts" =>
71                SandboxingFlagSet::SANDBOXED_SCRIPTS_BROWSING_CONTEXT_FLAG |
72                    SandboxingFlagSet::SANDBOXED_AUTOMATIC_FEATURES_BROWSING_CONTEXT_FLAG,
73            // The sandbox propagates to auxiliary browsing contexts flag, unless tokens contains the allow-popups-to-escape-sandbox keyword.
74            "allow-popups-to-escape-sandbox" =>
75                SandboxingFlagSet::SANDBOX_PROPOGATES_TO_AUXILIARY_BROWSING_CONTEXTS_FLAG,
76            // The sandboxed modals flag, unless tokens contains the allow-modals keyword.
77            "allow-modals" =>
78                SandboxingFlagSet::SANDBOXED_MODALS_FLAG,
79            // The sandboxed orientation lock browsing context flag, unless tokens contains the allow-orientation-lock keyword.
80            "allow-orientation-lock" =>
81                SandboxingFlagSet::SANDBOXED_ORIENTATION_LOCK_BROWSING_CONTEXT_FLAG,
82            // The sandboxed presentation browsing context flag, unless tokens contains the allow-presentation keyword.
83            "allow-presentation" =>
84                SandboxingFlagSet::SANDBOXED_PRESENTATION_BROWSING_CONTEXT_FLAG,
85            // The sandboxed downloads browsing context flag, unless tokens contains the allow-downloads keyword.
86            "allow-downloads" => SandboxingFlagSet::SANDBOXED_DOWNLOADS_BROWSING_CONTEXT_FLAG,
87            // The sandboxed custom protocols navigation browsing context flag, unless tokens contains either the
88            // allow-top-navigation-to-custom-protocols keyword, the allow-popups keyword, or the allow-top-navigation keyword.
89            "allow-top-navigation-to-custom-protocols" => SandboxingFlagSet::SANBOXED_CUSTOM_PROTOCOLS_NAVIGATION_BROWSING_CONTEXT_FLAG,
90            _ =>
91                SandboxingFlagSet::empty(),
92        };
93        output.remove(remove);
94    }
95    output
96}
content_security_policy/sandboxing_directive.rs

content_security_policy/
sandboxing_directive.rs
