use slicc_browsers::ProtectedOrigins;
use std::sync::OnceLock;
use url::Url;
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum Opener {
None,
Protected,
Unprotected,
Unknown,
}
#[derive(Clone, Debug)]
pub struct Protected {
rules: ProtectedOrigins,
extra: Vec<String>,
extra_hosts: Vec<String>,
}
fn catalog_rules() -> &'static ProtectedOrigins {
static RULES: OnceLock<ProtectedOrigins> = OnceLock::new();
RULES.get_or_init(|| slicc_browsers::catalog().protected_origins)
}
pub fn refusal() -> &'static str {
&catalog_rules().refusal
}
impl Default for Protected {
fn default() -> Self {
Self::new(&[])
}
}
impl Protected {
pub fn new(extra_origins: &[&str]) -> Self {
Self::with_rules(catalog_rules().clone(), extra_origins)
}
pub fn with_rules(rules: ProtectedOrigins, extra_origins: &[&str]) -> Self {
let parsed: Vec<Url> = extra_origins
.iter()
.filter_map(|text| parse(text))
.collect();
let extra = parsed.iter().filter_map(origin_of).collect();
let extra_hosts = parsed
.iter()
.filter(|url| url.host_str().is_some_and(|host| !host.is_empty()))
.map(host_of)
.collect();
Self {
rules,
extra,
extra_hosts,
}
}
pub fn refusal(&self) -> &str {
&self.rules.refusal
}
pub fn refusal_for_url(&self, text: &str) -> &str {
if self.rules.unparseable == "protected" && self.unparseable(text) {
&self.rules.unparseable_refusal
} else {
self.refusal()
}
}
pub fn unparseable(&self, text: &str) -> bool {
!matches!(text, "" | "null" | "://") && self.unwrap(parse(text)).is_none()
}
pub fn url(&self, text: &str) -> bool {
self.judge_url(text, false)
}
pub fn resource_key(&self, text: &str) -> Option<String> {
let mut url = self.unwrap(parse(text)).map(|url| self.rewrite_about(url))?;
url.set_username("").ok()?;
url.set_password(None).ok()?;
url.set_query(None);
url.set_fragment(None);
let path = url.path().trim_end_matches('/').to_string();
url.set_path(if path.is_empty() { "/" } else { &path });
Some(url.to_string())
}
pub fn redaction_schemes(&self) -> impl Iterator<Item = &str> {
self.rules.schemes.iter()
.chain(&self.rules.protected_schemes)
.chain(&self.rules.any_schemes)
.chain(&self.rules.inner_schemes)
.map(String::as_str)
.chain(self.extra.iter().filter_map(|origin| origin.split_once(':').map(|(scheme, _)| scheme)))
}
pub fn url_read_only(&self, text: &str) -> bool {
self.judge_url(text, true)
}
fn judge_url(&self, text: &str, read_only: bool) -> bool {
let Some(url) = self.unwrap(parse(text)).map(|url| self.rewrite_about(url)) else {
return !read_only && self.rules.unparseable == "protected" && !matches!(text, "" | "null" | "://");
};
let scheme = url.scheme();
if self
.rules
.protected_schemes
.iter()
.any(|item| item == scheme)
{
let pair = format!("{scheme}://{}", host_of(&url));
return !self.rules.scheme_exceptions.contains(&pair);
}
if self.rules.any_schemes.iter().any(|item| item == scheme) {
return true;
}
if self.rules.schemes.iter().any(|item| item == scheme) {
let host = host_of(&url);
if self.rules.hosts.contains(&host) {
return true;
}
if self.rules.domains.iter().any(|domain| under(&host, domain)) {
return true;
}
}
origin_of(&url).is_some_and(|origin| self.extra.contains(&origin))
}
pub fn target_type(&self, kind: &str) -> bool {
self.rules.target_types.iter().any(|item| item == kind)
}
pub fn error_page_url(&self, document_url: &str) -> bool {
self.rules.error_page.target == "previous"
&& !self.rules.error_page.url.is_empty()
&& document_url == self.rules.error_page.url
}
pub(crate) fn opaque_document(&self, text: &str, root: bool) -> bool {
root && (self.inheriting(text) || self.error_page_url(text))
|| self.unwrap(parse(text)).map(|url| self.rewrite_about(url)).is_some_and(|url| {
self.rules.scheme_exceptions.contains(&format!("{}://{}", url.scheme(), host_of(&url)))
})
}
pub(crate) fn data_document(&self, text: &str) -> bool {
parse(text).is_some_and(|url| url.scheme() == "data")
}
pub fn error_document(&self, document_url: &str, origin: &str) -> bool {
self.error_page_url(document_url) && origin == "://"
}
pub fn error_redaction(&self) -> bool {
self.rules.error_page.redact == "origin"
}
pub fn target(&self, text: &str, previous: bool, opener: Opener) -> bool {
if self.inheriting(text) {
return previous || matches!(opener, Opener::Protected | Opener::Unknown);
}
self.url(text)
}
pub fn target_with_document(&self, text: &str, previous: bool, opener: Opener, document_url: Option<&str>, unreachable_url: Option<&str>, navigating: bool) -> bool {
if document_url.is_some_and(|url| self.error_page_url(url))
&& unreachable_url == Some(text)
&& !navigating
{
return previous;
}
self.target(text, previous, opener)
}
pub fn cookie_domain(&self, domain: &str) -> bool {
let mut domain = domain.to_ascii_lowercase();
if let Some(rest) = domain.strip_prefix('.') {
domain = rest.to_string();
}
if let Some(rest) = domain.strip_suffix('.') {
domain = rest.to_string();
}
if domain.is_empty() {
return false;
}
if self.rules.domains.iter().any(|item| under(&domain, item)) {
return true;
}
self.rules
.domains
.iter()
.chain(self.rules.hosts.iter())
.chain(self.extra_hosts.iter())
.any(|host| under(host, &domain))
}
pub fn cookie_scope(&self, domain: &str) -> bool {
canonical_cookie_domain(domain).is_none_or(|host| self.cookie_domain(&host))
}
pub fn cookie_url(&self, text: &str) -> bool {
let Some(url) = self.unwrap(parse(text)) else {
return true;
};
let host = host_of(&url);
if host.is_empty() || self.url(text) {
return true;
}
if !matches!(url.host(), Some(url::Host::Domain(_))) {
return self.cookie_domain(&host);
}
let labels: Vec<&str> = host.split('.').collect();
(0..labels.len()).any(|at| self.cookie_scope(&labels[at..].join(".")))
}
pub fn storage_key(&self, key: &str) -> bool {
let mut parts = key.split('^');
let first = parts.next().unwrap_or("");
if self.url_read_only(first) {
return true;
}
parts
.filter_map(|part| part.strip_prefix('0'))
.any(|site| self.url_read_only(site))
}
pub fn pattern(&self, pattern: &str) -> bool {
let lowered = pattern.to_ascii_lowercase();
if self
.rules
.any_schemes
.iter()
.any(|scheme| lowered.starts_with(&format!("{scheme}:")))
{
return true;
}
let names: Vec<&String> = self
.rules
.domains
.iter()
.chain(self.rules.hosts.iter())
.chain(self.extra_hosts.iter())
.collect();
if pattern_hosts(&lowered)
.iter()
.any(|host| names.iter().any(|name| host_reaches(host, name)))
{
return true;
}
let literal: String = pattern
.chars()
.take_while(|ch| !matches!(ch, '*' | '?' | '{' | '}' | '[' | ']' | '\\'))
.collect();
literal.contains("://") && self.url_read_only(&literal)
}
pub(crate) fn inheriting(&self, text: &str) -> bool {
if text.is_empty() {
return true;
}
let Some(url) = parse(text) else {
return false;
};
url.scheme() == "about"
&& self
.rules
.inheriting
.iter()
.any(|item| *item == format!("about:{}", url.path().to_ascii_lowercase()))
}
fn rewrite_about(&self, url: Url) -> Url {
if url.scheme() != "about"
|| self.rules.about_scheme.is_empty()
|| self.inheriting(url.as_str())
{
return url;
}
let rest = &url.as_str()[url.scheme().len() + 1..];
parse(&format!("{}://{rest}", self.rules.about_scheme)).unwrap_or(url)
}
fn unwrap(&self, mut url: Option<Url>) -> Option<Url> {
let mut depth = 0;
while let Some(current) = url.as_ref() {
if !self
.rules
.inner_schemes
.iter()
.any(|item| item == current.scheme())
{
break;
}
if depth >= 8 {
return None;
}
let rest = current.as_str()[current.scheme().len() + 1..].to_string();
url = parse(&rest);
depth += 1;
}
url
}
}
fn pattern_hosts(pattern: &str) -> Vec<String> {
if let Some(index) = pattern.find("://") {
let scheme = &pattern[..index];
if !scheme.is_empty()
&& scheme.chars().all(|ch| {
ch.is_ascii_alphanumeric() || matches!(ch, '+' | '-' | '.' | '*' | '{' | '}' | ',')
})
{
let rest = &pattern[index + 3..];
let end = rest.find(['/', '#', '?']).unwrap_or(rest.len());
return authority_host(&rest[..end]).into_iter().collect();
}
}
let end = pattern.find(['#', '?']).unwrap_or(pattern.len());
pattern[..end]
.split('/')
.filter_map(authority_host)
.filter(|host| host.contains('.'))
.collect()
}
fn authority_host(authority: &str) -> Option<String> {
let host = authority.rsplit('@').next().unwrap_or(authority);
let host = match host.rfind(':') {
Some(index)
if !host.starts_with('[')
&& host[index + 1..]
.chars()
.all(|ch| ch.is_ascii_digit() || ch == '*') =>
{
&host[..index]
}
_ => host,
};
let host = host.strip_suffix('.').unwrap_or(host);
if host.is_empty()
|| host
.chars()
.all(|ch| matches!(ch, '*' | '?' | '{' | '}' | ','))
{
return None;
}
Some(host.to_string())
}
fn host_reaches(glob: &str, name: &str) -> bool {
let first: String = glob
.split('.')
.next()
.unwrap_or("")
.chars()
.filter(|ch| ch.is_ascii_alphanumeric() || *ch == '-')
.collect();
let label = if first.is_empty() {
"x".to_string()
} else {
first
};
[
name.to_string(),
format!("x.{name}"),
format!("{label}.{name}"),
]
.iter()
.any(|candidate| host_glob(glob.as_bytes(), candidate.as_bytes()))
}
fn host_glob(glob: &[u8], text: &[u8]) -> bool {
let Some((&first, rest)) = glob.split_first() else {
return text.is_empty();
};
match first {
b'*' => (0..=text.len()).any(|taken| host_glob(rest, &text[taken..])),
b'{' => match rest.iter().position(|ch| *ch == b'}') {
Some(close) => {
(0..=text.len()).any(|taken| host_glob(&rest[close + 1..], &text[taken..]))
}
None => text.first() == Some(&b'{') && host_glob(rest, &text[1..]),
},
b'?' => !text.is_empty() && host_glob(rest, &text[1..]),
b'\\' => match rest.split_first() {
Some((&literal, after)) => {
text.first() == Some(&literal) && host_glob(after, &text[1..])
}
None => text.is_empty(),
},
literal => text.first() == Some(&literal) && host_glob(rest, &text[1..]),
}
}
pub fn canonical_cookie_domain(domain: &str) -> Option<String> {
if domain.is_empty() || domain.chars().any(|ch| ch.is_whitespace() || matches!(ch, '/' | '\\' | '@' | '?' | '#')) {
return None;
}
let normalized = domain.replace(['。', '．', '｡'], ".");
let normalized = normalized.trim_start_matches('.');
let url = parse(&format!("http://{normalized}/"))?;
let host = host_of(&url).trim_matches('.').to_string();
if matches!(url.host(), Some(url::Host::Domain(_))) && host.split('.').any(|label| {
label.is_empty() || label.starts_with('-') || label.ends_with('-')
|| !label.bytes().all(|byte| byte.is_ascii_alphanumeric() || byte == b'-')
}) {
return None;
}
Some(host)
}
fn parse(text: &str) -> Option<Url> {
Url::parse(text).ok()
}
fn host_of(url: &Url) -> String {
let host = url.host_str().unwrap_or("").to_ascii_lowercase();
match host.strip_suffix('.') {
Some(stripped) => stripped.to_string(),
None => host,
}
}
fn origin_of(url: &Url) -> Option<String> {
url.host_str().filter(|host| !host.is_empty())?;
let host = host_of(url);
Some(match url.port() {
Some(port) => format!("{}://{host}:{port}", url.scheme()),
None => format!("{}://{host}", url.scheme()),
})
}
fn under(host: &str, domain: &str) -> bool {
host == domain || host.ends_with(&format!(".{domain}"))
}
#[cfg(test)]
mod tests {
use super::{Opener, Protected};
use slicc_browsers::protected::{
vectors, OPENER_PROTECTED, OPENER_UNKNOWN, OPENER_UNPROTECTED,
};
fn guard() -> Protected {
let vectors = vectors();
let origins: Vec<&str> = vectors.origins.iter().map(String::as_str).collect();
Protected::new(&origins)
}
#[test]
fn unparseable_policy_and_refusal_are_catalog_driven() {
let mut rules = slicc_browsers::catalog().protected_origins;
rules.unparseable_refusal = "custom unparseable refusal".into();
let guard = Protected::with_rules(rules.clone(), &[]);
for text in ["https://exa%20mple.example/", "blob:invalid", "view-source:invalid"] {
assert!(guard.unparseable(text));
assert!(guard.url(text));
assert!(!guard.url_read_only(text));
assert!(!guard.storage_key(text));
assert_eq!(guard.refusal_for_url(text), "custom unparseable refusal");
}
for text in ["", "null", "://"] {
assert!(!guard.unparseable(text));
assert!(!guard.url(text));
}
let at_limit = format!("{}https://example.test/", "view-source:".repeat(8));
assert!(!guard.unparseable(&at_limit));
assert!(!guard.url(&at_limit));
let over_limit = format!("view-source:{at_limit}");
assert!(guard.unparseable(&over_limit));
assert!(guard.url(&over_limit));
rules.unparseable = "not protected".into();
let guard = Protected::with_rules(rules, &[]);
assert!(!guard.url("https://exa%20mple.example/"));
assert_eq!(guard.refusal_for_url("https://exa%20mple.example/"), guard.refusal());
for url in ["http://xn--1ug.sliccy.ai/", "http://xn--a.sliccy.ai/"] {
let guard = Protected::default();
assert!(guard.url(url));
assert!(guard.unparseable(url));
}
}
#[test]
fn privileged_rules_are_catalog_driven() {
let mut rules = slicc_browsers::catalog().protected_origins;
rules.protected_schemes = vec!["privileged".into()];
rules.scheme_exceptions = vec!["privileged://newtab".into()];
rules.about_scheme = "privileged".into();
rules.target_types = vec!["custom_ui".into()];
let guard = Protected::with_rules(rules.clone(), &[]);
for url in ["privileged://settings", "about:settings", "view-source:about:settings", "blob:privileged://settings/id", "filesystem:privileged://settings/temporary/x"] {
assert!(guard.url(url), "{url}");
}
for url in ["privileged://newtab/path", "about:newtab/path", "about:blank", "about:srcdoc", "chrome://settings"] {
assert!(!guard.url(url), "{url}");
}
assert!(guard.target_type("custom_ui"));
assert!(!guard.target_type("browser_ui"));
rules.about_scheme.clear();
assert!(!Protected::with_rules(rules, &[]).url("about:settings"));
}
#[test]
fn every_url_vector_matches_slicc_browsers() {
let guard = guard();
for vector in vectors().urls {
assert_eq!(guard.url(&vector.url), vector.protected, "{:?}", vector.url);
}
}
#[test]
fn every_target_vector_matches_slicc_browsers() {
let guard = guard();
for vector in vectors().targets {
let opener = match vector.opener.as_deref() {
None => Opener::None,
Some(OPENER_PROTECTED) => Opener::Protected,
Some(OPENER_UNPROTECTED) => Opener::Unprotected,
Some(OPENER_UNKNOWN) => Opener::Unknown,
Some(other) => panic!("unknown opener {other}"),
};
assert_eq!(
guard.target_type(vector.kind.as_deref().unwrap_or(""))
|| guard.target_with_document(&vector.url, vector.previous, opener, vector.document_url.as_deref(), vector.unreachable_url.as_deref(), vector.navigating),
vector.protected,
"{vector:?}"
);
}
}
#[test]
fn every_cookie_and_storage_vector_matches_slicc_browsers() {
let guard = guard();
let all = vectors();
for vector in all.cookie_domains {
assert_eq!(
guard.cookie_domain(&vector.domain),
vector.protected,
"{vector:?}"
);
}
for vector in all.storage_keys {
assert_eq!(
guard.storage_key(&vector.key),
vector.protected,
"{vector:?}"
);
}
}
#[test]
fn patterns_that_name_seven_or_the_vault_are_protected() {
let guard = Protected::default();
for pattern in [
"https://vault.sliccy.ai/*",
"**://*.sliccy.ai/**",
"*sliccy.ai*",
"https://SEVEN.SLICCY.AI/api/*",
"https://www.sliccy.ai/auth/callback*",
"devtools://*",
"https://sliccy.ai/",
] {
assert!(guard.pattern(pattern), "{pattern}");
}
for pattern in [
"**://*.sliccy.ai/**",
"**/*.sliccy.ai/**",
"https://seven.sliccy.*/x",
"https://user@vault.sliccy.ai:443/x",
"https://vault.sliccy.ai./x",
"*://{seven,other}.sliccy.ai/*",
] {
assert!(guard.pattern(pattern), "{pattern}");
}
for pattern in [
"*",
"**/*",
"**/api/users",
"https://*/api",
"https://example.com/*",
"https://vault-sliccy.example/*",
"https://notsliccy.ai/*",
"https://vault.sliccy.ai.example/*",
"https://vault-sliccy.ai/*",
"**/x?next=https://seven.sliccy.ai/",
"https://example.com/?next=https://seven.sliccy.ai/",
"*/blocked*",
"**/api/*/details",
] {
assert!(!guard.pattern(pattern), "{pattern}");
}
assert_eq!(
guard.refusal(),
"slicc: refused: target is on seven's origin"
);
}
}