Apply frame-src content-security-policy to WebUI pages.

chrome/browser/ui/webui/chrome_url_data_manager_backend.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/chrome_url_data_manager_backend.h"
 
 #include <set>
 
 #include "base/basictypes.h"
 #include "base/bind.h"
@@ skipping 70 matching lines @@
     insert(chrome::kChromeUISystemInfoHost);
 #endif
 #if defined(OS_CHROMEOS) || defined(USE_AURA)
     insert(chrome::kChromeUICollectedCookiesHost);
     insert(chrome::kChromeUIHttpAuthHost);
     insert(chrome::kChromeUITabModalConfirmDialogHost);
 #endif
   }
 };
 
-// It is OK to add URLs to this set which slightly reduces the CSP for them.
-class ChromeURLContentSecurityPolicyObjectTagSet
-    : public std::set<std::string> {
+// It is OK to add URLs to these maps and slightly reduce the CSP protection
+// applied to the WebUI page.

[Evan Stade, 2012/08/21 20:56:26]

documentation for what this is a map from and to

+class ChromeURLObjectSrcExceptionMap
+    : public std::map<std::string, std::string> {
  public:
-  ChromeURLContentSecurityPolicyObjectTagSet() : std::set<std::string>() {
-    insert(chrome::kChromeUIPrintHost);
+  ChromeURLObjectSrcExceptionMap() : std::map<std::string, std::string>() {
+    insert(std::pair<std::string, std::string>(
+        chrome::kChromeUIPrintHost, "object-src 'self';"));
+  }
+};
+
+class ChromeURLFrameSrcExceptionMap
+    : public std::map<std::string, std::string> {
+ public:
+  ChromeURLFrameSrcExceptionMap() : std::map<std::string, std::string>() {
+    insert(std::pair<std::string, std::string>(
+        chrome::kChromeUIUberHost, "frame-src chrome:;"));
+    insert(std::pair<std::string, std::string>(
+        chrome::kChromeUIUberFrameHost, "frame-src chrome:;"));
   }
 };
 
 base::LazyInstance<ChromeURLContentSecurityPolicyExceptionSet>
     g_chrome_url_content_security_policy_exception_set =
         LAZY_INSTANCE_INITIALIZER;
 
-base::LazyInstance<ChromeURLContentSecurityPolicyObjectTagSet>
-    g_chrome_url_content_security_policy_object_tag_set =
-        LAZY_INSTANCE_INITIALIZER;
+base::LazyInstance<ChromeURLObjectSrcExceptionMap>
+    g_chrome_url_object_src_exception_map = LAZY_INSTANCE_INITIALIZER;
+
+base::LazyInstance<ChromeURLFrameSrcExceptionMap>
+    g_chrome_url_frame_src_exception_map = LAZY_INSTANCE_INITIALIZER;
 
 // Determine the least-privileged content security policy header, if any,
 // that is compatible with a given WebUI URL, and append it to the existing
 // response headers.
 void AddContentSecurityPolicyHeader(
     const GURL& url, net::HttpResponseHeaders* headers) {
   ChromeURLContentSecurityPolicyExceptionSet* exceptions =
       g_chrome_url_content_security_policy_exception_set.Pointer();
 
   if (exceptions->find(url.host()) == exceptions->end()) {
     std::string base = kChromeURLContentSecurityPolicyHeaderBase;
-    ChromeURLContentSecurityPolicyObjectTagSet* object_tag_set =
-        g_chrome_url_content_security_policy_object_tag_set.Pointer();
 
-    base.append(object_tag_set->find(url.host()) == object_tag_set->end() ?
-                "object-src 'none';" :
-                "object-src 'self';");
+    ChromeURLObjectSrcExceptionMap* object_map =
+        g_chrome_url_object_src_exception_map.Pointer();
+    ChromeURLObjectSrcExceptionMap::iterator object_iter =
+        object_map->find(url.host());
+    base.append(object_iter == object_map->end() ?
+                "object-src 'none';" : object_iter->second);
+
+    ChromeURLFrameSrcExceptionMap* frame_map =
+        g_chrome_url_frame_src_exception_map.Pointer();
+    ChromeURLFrameSrcExceptionMap::iterator frame_iter =
+        frame_map->find(url.host());
+    base.append(frame_iter == frame_map->end() ?
+                "frame-src 'none';" : frame_iter->second);
 
     headers->AddHeader(base);
   }
 }
 
 // Parse a URL into the components used to resolve its request. |source_name|
 // is the hostname and |path| is the remaining portion of the URL.
 void URLToRequest(const GURL& url, std::string* source_name,
                   std::string* path) {
   DCHECK(url.SchemeIs(chrome::kChromeDevToolsScheme) ||
@@ skipping 464 matching lines @@
 
   return new URLRequestChromeJob(request, backend_);
 }
 
 }  // namespace
 
 net::URLRequestJobFactory::ProtocolHandler*
 CreateDevToolsProtocolHandler(ChromeURLDataManagerBackend* backend) {
   return new DevToolsJobFactory(backend);
 }