script/dom/reporting/
reportingendpoint.rs

1/* This Source Code Form is subject to the terms of the Mozilla Public
2 * License, v. 2.0. If a copy of the MPL was not distributed with this
3 * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
4
5use std::collections::HashMap;
6
7use headers::{ContentType, HeaderMapExt};
8use http::HeaderMap;
9use hyper_serde::Serde;
10use malloc_size_of_derive::MallocSizeOf;
11use net_traits::request::{
12    CredentialsMode, Destination, RequestBody, RequestId, RequestMode,
13    create_request_body_with_content,
14};
15use net_traits::{FetchMetadata, NetworkError, ResourceFetchTiming};
16use script_bindings::str::DOMString;
17use serde::Serialize;
18use servo_url::{ImmutableOrigin, ServoUrl};
19
20use crate::dom::bindings::codegen::Bindings::CSPViolationReportBodyBinding::CSPViolationReportBody;
21use crate::dom::bindings::codegen::Bindings::ReportingObserverBinding::Report;
22use crate::dom::bindings::codegen::Bindings::SecurityPolicyViolationEventBinding::SecurityPolicyViolationEventDisposition;
23use crate::dom::bindings::refcounted::Trusted;
24use crate::dom::bindings::root::DomRoot;
25use crate::dom::csp::Violation;
26use crate::dom::csppolicyviolationreport::serialize_disposition;
27use crate::dom::globalscope::GlobalScope;
28use crate::dom::performance::performanceresourcetiming::InitiatorType;
29use crate::fetch::{RequestWithGlobalScope, create_a_potential_cors_request};
30use crate::network_listener::{FetchResponseListener, ResourceTimingListener, submit_timing};
31
32/// <https://w3c.github.io/reporting/#endpoint>
33#[derive(Clone, Eq, Hash, MallocSizeOf, PartialEq)]
34pub(crate) struct ReportingEndpoint {
35    /// <https://w3c.github.io/reporting/#dom-endpoint-name>
36    name: DOMString,
37    /// <https://w3c.github.io/reporting/#dom-endpoint-url>
38    url: ServoUrl,
39    /// <https://w3c.github.io/reporting/#dom-endpoint-failures>
40    failures: u32,
41}
42
43impl ReportingEndpoint {
44    /// <https://w3c.github.io/reporting/#process-header>
45    pub(crate) fn parse_reporting_endpoints_header(
46        response_url: &ServoUrl,
47        headers: &Option<Serde<HeaderMap>>,
48    ) -> Option<Vec<ReportingEndpoint>> {
49        let headers = headers.as_ref()?;
50        let reporting_headers = headers.get_all("reporting-endpoints");
51        // Step 2. Let parsed header be the result of executing get a structured field value
52        // given "Reporting-Endpoints" and "dictionary" from response’s header list.
53        let mut parsed_header = Vec::new();
54        for header in reporting_headers.iter() {
55            let Some(header_value) = header.to_str().ok() else {
56                continue;
57            };
58            parsed_header.append(&mut header_value.split(",").map(|s| s.trim()).collect());
59        }
60        // Step 3. If parsed header is null, abort these steps.
61        if parsed_header.is_empty() {
62            return None;
63        }
64        // Step 4. Let endpoints be an empty list.
65        let mut endpoints = Vec::new();
66        // Step 5. For each name → value_and_parameters of parsed header:
67        for header in parsed_header {
68            // There could be a '=' in the URL itself (for example query parameters). Therefore, we can't
69            // split on '=', but instead look for the first one.
70            let Some(split_index) = header.find('=') else {
71                continue;
72            };
73            // Step 5.1. Let endpoint url string be the first element of the tuple value_and_parameters.
74            // If endpoint url string is not a string, then continue.
75            let (name, endpoint_url_string) = header.split_at(split_index);
76            let length = endpoint_url_string.len();
77            let endpoint_bytes = endpoint_url_string.as_bytes();
78            // Note that the first character is the '=' and we check for the next and last character to be '"'
79            if length < 3 || endpoint_bytes[1] != b'"' || endpoint_bytes[length - 1] != b'"' {
80                continue;
81            }
82            // The '="' at the start and '"' at the end removed
83            let endpoint_url_value = &endpoint_url_string[2..length - 1];
84            // Step 5.2. Let endpoint url be the result of executing the URL parser on endpoint url string,
85            // with base URL set to response’s url. If endpoint url is failure, then continue.
86            let Ok(endpoint_url) =
87                ServoUrl::parse_with_base(Some(response_url), endpoint_url_value)
88            else {
89                continue;
90            };
91            // Step 5.3. If endpoint url’s origin is not potentially trustworthy, then continue.
92            if !endpoint_url.is_potentially_trustworthy() {
93                continue;
94            }
95            // Step 5.4. Let endpoint be a new endpoint whose properties are set as follows:
96            // Step 5.5. Add endpoint to endpoints.
97            endpoints.push(ReportingEndpoint {
98                name: name.into(),
99                url: endpoint_url,
100                failures: 0,
101            });
102        }
103        Some(endpoints)
104    }
105}
106
107pub(crate) trait SendReportsToEndpoints {
108    /// <https://w3c.github.io/reporting/#send-reports>
109    fn send_reports_to_endpoints(&self, reports: Vec<Report>, endpoints: Vec<ReportingEndpoint>);
110    /// <https://w3c.github.io/reporting/#try-delivery>
111    fn attempt_to_deliver_reports_to_endpoints(
112        &self,
113        endpoint: &ServoUrl,
114        origin: ImmutableOrigin,
115        reports: &[&Report],
116    );
117    /// <https://w3c.github.io/reporting/#serialize-a-list-of-reports-to-json>
118    fn serialize_list_of_reports(reports: &[&Report]) -> Option<RequestBody>;
119}
120
121impl SendReportsToEndpoints for GlobalScope {
122    fn send_reports_to_endpoints(
123        &self,
124        mut reports: Vec<Report>,
125        endpoints: Vec<ReportingEndpoint>,
126    ) {
127        // Step 1. Let endpoint map be an empty map of endpoint objects to lists of report objects.
128        #[expect(clippy::mutable_key_type)]
129        // See `impl Hash for DOMString`.
130        let mut endpoint_map: HashMap<&ReportingEndpoint, Vec<Report>> = HashMap::new();
131        // Step 2. For each report in reports:
132        reports.retain(|report| {
133            // Step 2.1. If there exists an endpoint (endpoint) in context’s endpoints
134            // list whose name is report’s destination:
135            if let Some(endpoint) = endpoints.iter().find(|e| e.name == report.destination) {
136                // Step 2.1.1. Append report to endpoint map’s list of reports for endpoint.
137                endpoint_map
138                    .entry(endpoint)
139                    .or_default()
140                    .push(report.clone());
141                true
142            } else {
143                // Step 2.1.2. Otherwise, remove report from reports.
144                false
145            }
146        });
147        // Step 3. For each (endpoint, report list) pair in endpoint map:
148        for (endpoint, report_list) in endpoint_map.iter() {
149            // Step 3.1. Let origin map be an empty map of origins to lists of report objects.
150            let mut origin_map: HashMap<ImmutableOrigin, Vec<&Report>> = HashMap::new();
151            // Step 3.2. For each report in report list:
152            for report in report_list {
153                let Ok(url) = ServoUrl::parse(&report.url.str()) else {
154                    continue;
155                };
156                // Step 3.2.1. Let origin be the origin of report’s url.
157                let origin = url.origin();
158                // Step 3.2.2. Append report to origin map’s list of reports for origin.
159                origin_map.entry(origin).or_default().push(report);
160            }
161            // Step 3.3. For each (origin, per-origin reports) pair in origin map,
162            // execute the following steps asynchronously:
163            for (origin, origin_report_list) in origin_map.iter() {
164                // Step 3.3.1. Let result be the result of executing
165                // § 3.5.2 Attempt to deliver reports to endpoint on endpoint, origin, and per-origin reports.
166                self.attempt_to_deliver_reports_to_endpoints(
167                    &endpoint.url,
168                    origin.clone(),
169                    origin_report_list,
170                );
171                // Step 3.3.2. If result is "Failure":
172                // TODO(37238)
173                // Step 3.3.2.1. Increment endpoint’s failures.
174                // TODO(37238)
175                // Step 3.3.3. If result is "Remove Endpoint":
176                // TODO(37238)
177                // Step 3.3.3.1 Remove endpoint from context’s endpoints list.
178                // TODO(37238)
179                // Step 3.3.4. Remove each report from reports.
180                // TODO(37238)
181            }
182        }
183    }
184
185    fn attempt_to_deliver_reports_to_endpoints(
186        &self,
187        endpoint: &ServoUrl,
188        origin: ImmutableOrigin,
189        reports: &[&Report],
190    ) {
191        // Step 1. Let body be the result of executing serialize a list of reports to JSON on reports.
192        let request_body = Self::serialize_list_of_reports(reports);
193        // Step 2. Let request be a new request with the following properties [FETCH]:
194        let mut headers = HeaderMap::with_capacity(1);
195        headers.typed_insert(ContentType::from(
196            "application/reports+json".parse::<mime::Mime>().unwrap(),
197        ));
198        let request = create_a_potential_cors_request(
199            None,
200            endpoint.clone(),
201            Destination::Report,
202            None,
203            None,
204            self.get_referrer(),
205        )
206        .with_global_scope(self)
207        .method(http::Method::POST)
208        .body(request_body)
209        .origin(origin)
210        .mode(RequestMode::CorsMode)
211        .credentials_mode(CredentialsMode::CredentialsSameOrigin)
212        .unsafe_request(true)
213        .headers(headers);
214        // Step 3. Queue a task to fetch request.
215        self.fetch(
216            request,
217            CSPReportEndpointFetchListener {
218                endpoint: endpoint.clone(),
219                global: Trusted::new(self),
220            },
221            self.task_manager().networking_task_source().into(),
222        );
223        // Step 4. Wait for a response (response).
224        // TODO(37238)
225        // Step 5. If response’s status is an OK status (200-299), return "Success".
226        // TODO(37238)
227        // Step 6. If response’s status is 410 Gone [RFC9110], return "Remove Endpoint".
228        // TODO(37238)
229        // Step 7. Return "Failure".
230        // TODO(37238)
231    }
232
233    fn serialize_list_of_reports(reports: &[&Report]) -> Option<RequestBody> {
234        // Step 1. Let collection be an empty list.
235        // Step 2. For each report in reports:
236        let report_body: Vec<SerializedReport> = reports
237            .iter()
238            // Step 2.1. Let data be a map with the following key/value pairs:
239            .map(|r| SerializedReport {
240                // TODO(37238)
241                age: 0,
242                type_: r.type_.to_string(),
243                url: r.url.to_string(),
244                user_agent: "".to_owned(),
245                body: r.body.clone().map(|b| b.into()),
246            })
247            // Step 2.2. Increment report’s attempts.
248            // TODO(37238)
249            // Step 2.3. Append data to collection.
250            .collect();
251        // Step 3. Return the byte sequence resulting from executing serialize an
252        // Infra value to JSON bytes on collection.
253        Some(create_request_body_with_content(
254            &serde_json::to_string(&report_body).unwrap_or("".to_owned()),
255        ))
256    }
257}
258
259#[derive(Serialize)]
260struct SerializedReport {
261    age: u64,
262    #[serde(rename = "type")]
263    type_: String,
264    url: String,
265    user_agent: String,
266    body: Option<CSPReportingEndpointBody>,
267}
268
269#[derive(Clone, Debug, Serialize)]
270#[serde(rename_all = "camelCase")]
271pub(crate) struct CSPReportingEndpointBody {
272    sample: Option<String>,
273    #[serde(rename = "blockedURL")]
274    blocked_url: Option<String>,
275    referrer: Option<String>,
276    status_code: u16,
277    #[serde(rename = "documentURL")]
278    document_url: String,
279    source_file: Option<String>,
280    effective_directive: String,
281    line_number: Option<u32>,
282    column_number: Option<u32>,
283    original_policy: String,
284    #[serde(serialize_with = "serialize_disposition")]
285    disposition: SecurityPolicyViolationEventDisposition,
286}
287
288impl From<CSPViolationReportBody> for CSPReportingEndpointBody {
289    fn from(value: CSPViolationReportBody) -> Self {
290        CSPReportingEndpointBody {
291            sample: value.sample.map(|s| s.to_string()),
292            blocked_url: value.blockedURL.map(|s| s.to_string()),
293            referrer: value.referrer.map(|s| s.to_string()),
294            status_code: value.statusCode,
295            document_url: value.documentURL.to_string(),
296            source_file: value.sourceFile.map(|s| s.to_string()),
297            effective_directive: value.effectiveDirective.to_string(),
298            line_number: value.lineNumber,
299            column_number: value.columnNumber,
300            original_policy: value.originalPolicy.into(),
301            disposition: value.disposition,
302        }
303    }
304}
305
306struct CSPReportEndpointFetchListener {
307    /// Endpoint URL of this request.
308    endpoint: ServoUrl,
309    /// The global object fetching the report uri violation
310    global: Trusted<GlobalScope>,
311}
312
313impl FetchResponseListener for CSPReportEndpointFetchListener {
314    fn process_request_body(&mut self, _: RequestId) {}
315
316    fn process_response(
317        &mut self,
318        _: &mut js::context::JSContext,
319        _: RequestId,
320        fetch_metadata: Result<FetchMetadata, NetworkError>,
321    ) {
322        _ = fetch_metadata;
323    }
324
325    fn process_response_chunk(
326        &mut self,
327        _: &mut js::context::JSContext,
328        _: RequestId,
329        chunk: Vec<u8>,
330    ) {
331        _ = chunk;
332    }
333
334    fn process_response_eof(
335        self,
336        cx: &mut js::context::JSContext,
337        _: RequestId,
338        response: Result<(), NetworkError>,
339        timing: ResourceFetchTiming,
340    ) {
341        submit_timing(cx, &self, &response, &timing);
342    }
343
344    fn process_csp_violations(&mut self, _request_id: RequestId, _violations: Vec<Violation>) {}
345}
346
347impl ResourceTimingListener for CSPReportEndpointFetchListener {
348    fn resource_timing_information(&self) -> (InitiatorType, ServoUrl) {
349        (InitiatorType::Other, self.endpoint.clone())
350    }
351
352    fn resource_timing_global(&self) -> DomRoot<GlobalScope> {
353        self.global.root()
354    }
355}
script/dom/reporting/reportingendpoint.rs

script/dom/reporting/
reportingendpoint.rs
