[librsvg] handle::acquire_data() - Take an AllowedUrl, not a string href

[Federico Mena Quintero <federico src gnome org>]

commit 71b7c7c314b7024bda9c46842f38a45d2be9f1ff
Author: Federico Mena Quintero <federico gnome org>
Date:   Wed Nov 28 14:06:32 2018 -0600

    handle::acquire_data() - Take an AllowedUrl, not a string href
    
    This trickles down to a bunch of the code.

 rsvg_internals/src/filters/image.rs |  4 ++-
 rsvg_internals/src/handle.rs        | 61 +++++++++++++++++++++++++------------
 rsvg_internals/src/xml.rs           | 28 +++++++++++------
 3 files changed, 64 insertions(+), 29 deletions(-)
---
diff --git a/rsvg_internals/src/filters/image.rs b/rsvg_internals/src/filters/image.rs
index f6a28d69..74dbc452 100644
--- a/rsvg_internals/src/filters/image.rs
+++ b/rsvg_internals/src/filters/image.rs
@@ -56,7 +56,9 @@ impl Image {
             _ => unreachable!(),
         };
 
-        let acquired_drawable = draw_ctx.get_acquired_node(&url).ok_or(FilterError::InvalidInput)?;
+        let acquired_drawable = draw_ctx
+            .get_acquired_node(&url)
+            .ok_or(FilterError::InvalidInput)?;
         let drawable = acquired_drawable.get();
 
         let surface = ImageSurface::create(
diff --git a/rsvg_internals/src/handle.rs b/rsvg_internals/src/handle.rs
index 983897c1..39de17e3 100644
--- a/rsvg_internals/src/handle.rs
+++ b/rsvg_internals/src/handle.rs
@@ -90,13 +90,8 @@ pub struct BinaryData {
     pub content_type: Option<String>,
 }
 
-pub fn acquire_data(handle: *mut RsvgHandle, href: &str) -> Result<BinaryData, glib::Error> {
-    let rhandle = get_rust_handle(handle);
-
-    let aurl = AllowedUrl::from_href(href, rhandle.base_url.borrow().as_ref())
-        .map_err(|_| glib::Error::new(RsvgError, "FIXME"))?;
-
-    io::acquire_data(&aurl, get_cancellable(handle).as_ref())
+pub fn acquire_data(handle: *mut RsvgHandle, aurl: &AllowedUrl) -> Result<BinaryData, glib::Error> {
+    io::acquire_data(aurl, get_cancellable(handle).as_ref())
         .map_err(|_| glib::Error::new(RsvgError, "FIXME"))
 }
 
@@ -116,9 +111,14 @@ fn keep_image_data(handle: *const RsvgHandle) -> bool {
 
 pub fn image_surface_new_from_href(
     handle: *mut RsvgHandle,
-    href: &str,
+    href_str: &str,
 ) -> Result<ImageSurface, LoadingError> {
-    let data = acquire_data(handle, href)?;
+    let rhandle = get_rust_handle(handle);
+
+    let aurl = AllowedUrl::from_href(href_str, rhandle.base_url.borrow().as_ref())
+        .map_err(|_| glib::Error::new(RsvgError, "FIXME"))?;
+
+    let data = acquire_data(handle, &aurl)?;
 
     if data.data.len() == 0 {
         return Err(LoadingError::EmptyData);
@@ -173,21 +173,34 @@ pub fn image_surface_new_from_href(
 }
 
 // FIXME: distinguish between "file not found" and "invalid XML"
-pub fn load_xml_xinclude(handle: *mut RsvgHandle, href: &str) -> bool {
+pub fn load_xml_xinclude(handle: *mut RsvgHandle, aurl: &AllowedUrl) -> bool {
+    let href = aurl.url().as_str();
+
     unsafe { from_glib(rsvg_load_handle_xml_xinclude(handle, href.to_glib_none().0)) }
 }
 
 // This function just slurps CSS data from a possibly-relative href
 // and parses it.  We'll move it to a better place in the end.
-pub fn load_css(css_styles: &mut CssStyles, handle: *mut RsvgHandle, href: &str) {
-    if let Ok(data) = acquire_data(handle, href) {
+pub fn load_css(css_styles: &mut CssStyles, handle: *mut RsvgHandle, href_str: &str) {
+    let rhandle = get_rust_handle(handle);
+
+    let aurl = match AllowedUrl::from_href(href_str, rhandle.base_url.borrow().as_ref()) {
+        Ok(a) => a,
+        Err(_) => {
+            rsvg_log!("Could not load \"{}\" for CSS data", href_str);
+            // FIXME: report errors; this should be a fatal error
+            return;
+        }
+    };
+
+    if let Ok(data) = acquire_data(handle, &aurl) {
         let BinaryData {
             data: bytes,
             content_type,
         } = data;
 
         if content_type.as_ref().map(String::as_ref) != Some("text/css") {
-            rsvg_log!("\"{}\" is not of type text/css; ignoring", href);
+            rsvg_log!("\"{}\" is not of type text/css; ignoring", href_str);
             // FIXME: report errors
             return;
         }
@@ -197,13 +210,13 @@ pub fn load_css(css_styles: &mut CssStyles, handle: *mut RsvgHandle, href: &str)
         } else {
             rsvg_log!(
                 "\"{}\" does not contain valid UTF-8 CSS data; ignoring",
-                href
+                href_str
             );
             // FIXME: report errors
             return;
         }
     } else {
-        rsvg_log!("Could not load \"{}\" for CSS data", href);
+        rsvg_log!("Could not load \"{}\" for CSS data", href_str);
         // FIXME: report errors from not being to acquire data; this should be a fatal error
     }
 }
@@ -267,16 +280,26 @@ pub unsafe extern "C" fn rsvg_handle_rust_get_base_gfile(
 #[no_mangle]
 pub unsafe extern "C" fn rsvg_handle_acquire_data(
     handle: *mut RsvgHandle,
-    href: *const libc::c_char,
+    href_str: *const libc::c_char,
     out_len: *mut usize,
     error: *mut *mut glib_sys::GError,
 ) -> *mut libc::c_char {
-    assert!(!href.is_null());
+    assert!(!href_str.is_null());
     assert!(!out_len.is_null());
 
-    let href: String = from_glib_none(href);
+    let href_str: String = from_glib_none(href_str);
+
+    let rhandle = get_rust_handle(handle);
+
+    let aurl = match AllowedUrl::from_href(&href_str, rhandle.base_url.borrow().as_ref()) {
+        Ok(a) => a,
+        Err(_) => {
+            set_gerror(error, 0, "URL is not allowed");
+            return ptr::null_mut();
+        }
+    };
 
-    match acquire_data(handle, &href) {
+    match acquire_data(handle, &aurl) {
         Ok(binary) => {
             if !error.is_null() {
                 *error = ptr::null_mut();
diff --git a/rsvg_internals/src/xml.rs b/rsvg_internals/src/xml.rs
index 7f0452f9..41fc8e01 100644
--- a/rsvg_internals/src/xml.rs
+++ b/rsvg_internals/src/xml.rs
@@ -9,6 +9,7 @@ use std::ptr;
 use std::rc::Rc;
 use std::str;
 
+use allowed_url::AllowedUrl;
 use attributes::Attribute;
 use create_node::create_node_and_register_id;
 use css::{self, CssStyles, RsvgCssStyles};
@@ -417,15 +418,24 @@ impl XmlState {
         encoding: Option<&str>,
     ) -> Result<(), AcquireError> {
         if let Some(href) = href {
+            let aurl = AllowedUrl::from_href(href, handle::get_base_url(handle).as_ref()).map_err(
+                |e| {
+                    // FIXME: should AlloweUrlError::HrefParseError be a fatal error,
+                    // not a resource error?
+                    rsvg_log!("could not acquire \"{}\": {}", href, e);
+                    AcquireError::ResourceError
+                },
+            )?;
+
             // https://www.w3.org/TR/xinclude/#include_element
             //
             // "When omitted, the value of "xml" is implied (even in
             // the absence of a default value declaration). Values
             // other than "xml" and "text" are a fatal error."
             match parse {
-                None | Some("xml") => self.acquire_xml(handle, href),
+                None | Some("xml") => self.acquire_xml(handle, &aurl),
 
-                Some("text") => self.acquire_text(handle, href, encoding),
+                Some("text") => self.acquire_text(handle, &aurl, encoding),
 
                 _ => Err(AcquireError::FatalError),
             }
@@ -442,18 +452,18 @@ impl XmlState {
     fn acquire_text(
         &mut self,
         handle: *mut RsvgHandle,
-        href: &str,
+        aurl: &AllowedUrl,
         encoding: Option<&str>,
     ) -> Result<(), AcquireError> {
-        let binary = handle::acquire_data(handle, href).map_err(|e| {
-            rsvg_log!("could not acquire \"{}\": {}", href, e);
+        let binary = handle::acquire_data(handle, aurl).map_err(|e| {
+            rsvg_log!("could not acquire \"{}\": {}", aurl.url(), e);
             AcquireError::ResourceError
         })?;
 
         let encoding = encoding.unwrap_or("utf-8");
 
         let encoder = encoding_from_whatwg_label(encoding).ok_or_else(|| {
-            rsvg_log!("unknown encoding \"{}\" for \"{}\"", encoding, href);
+            rsvg_log!("unknown encoding \"{}\" for \"{}\"", encoding, aurl.url());
             AcquireError::FatalError
         })?;
 
@@ -462,7 +472,7 @@ impl XmlState {
             .map_err(|e| {
                 rsvg_log!(
                     "could not convert contents of \"{}\" from character encoding \"{}\": {}",
-                    href,
+                    aurl.url(),
                     encoding,
                     e
                 );
@@ -473,9 +483,9 @@ impl XmlState {
         Ok(())
     }
 
-    fn acquire_xml(&self, handle: *mut RsvgHandle, href: &str) -> Result<(), AcquireError> {
+    fn acquire_xml(&self, handle: *mut RsvgHandle, aurl: &AllowedUrl) -> Result<(), AcquireError> {
         // FIXME: distinguish between "file not found" and "invalid XML"
-        if handle::load_xml_xinclude(handle, href) {
+        if handle::load_xml_xinclude(handle, aurl) {
             Ok(())
         } else {
             Err(AcquireError::FatalError)