Take script URLs into account when applying script content settings.

chrome/renderer/content_settings_observer.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/content_settings_observer.h"
 
 #include "chrome/common/render_messages.h"
 #include "chrome/common/url_constants.h"
 #include "content/public/renderer/navigation_state.h"
 #include "content/public/renderer/render_view.h"
@@ skipping 41 matching lines @@
 
 GURL GetOriginOrURL(const WebFrame* frame) {
   WebString top_origin = frame->top()->document().securityOrigin().toString();
   // The the |top_origin| is unique ("null") e.g., for file:// URLs. Use the
   // document URL as the primary URL in those cases.
   if (top_origin == "null")
     return frame->document().url();
   return GURL(top_origin);
 }
 
+ContentSetting GetContentSettingFromRules(
+    const ContentSettingsForOneType& rules,
+    const GURL& primary_url,
+    const GURL& secondary_url) {
+  ContentSettingsForOneType::const_iterator it;
+  for (it = rules.begin(); it != rules.end(); ++it) {
+    if (it->primary_pattern.Matches(primary_url) &&
+        it->secondary_pattern.Matches(secondary_url)) {
+      return it->setting;
+    }
+  }
+  return CONTENT_SETTING_DEFAULT;

[jochen (gone - plz use gerrit), 2011/11/03 15:55:09]

what if the default is to block all images?

[marja, 2011/11/03 16:28:39]

Ahh, I should've put NOTREACHED() here but I forgot. The last rule is supposed
the be the default rule (*, *). Added the NOTREACHED().

+}
+
 }  // namespace
 
 ContentSettingsObserver::ContentSettingsObserver(
     content::RenderView* render_view)
     : content::RenderViewObserver(render_view),
       content::RenderViewObserverTracker<ContentSettingsObserver>(render_view),
       default_content_settings_(NULL),
-      image_setting_rules_(NULL),
+      content_setting_rules_(NULL),
       plugins_temporarily_allowed_(false) {
   ClearBlockedContentSettings();
 }
 
 ContentSettingsObserver::~ContentSettingsObserver() {
 }
 
 void ContentSettingsObserver::SetContentSettings(
     const ContentSettings& settings) {
   current_content_settings_ = settings;
 }
 
 void ContentSettingsObserver::SetDefaultContentSettings(
     const ContentSettings* settings) {
   default_content_settings_ = settings;
 }
 
-void ContentSettingsObserver::SetImageSettingRules(
-    const ContentSettingsForOneType* image_setting_rules) {
-  image_setting_rules_ = image_setting_rules;
+void ContentSettingsObserver::SetContentSettingRules(
+    const RendererContentSettingRules* content_setting_rules) {
+  content_setting_rules_ = content_setting_rules;
 }
 
 ContentSetting ContentSettingsObserver::GetContentSetting(
     ContentSettingsType type) {
   // Don't call this for plug-ins.
   DCHECK_NE(CONTENT_SETTINGS_TYPE_PLUGINS, type);
   return current_content_settings_.settings[type];
 }
 
 void ContentSettingsObserver::DidBlockContentType(
@@ skipping 25 matching lines @@
 }
 
 void ContentSettingsObserver::DidCommitProvisionalLoad(
     WebFrame* frame, bool is_new_navigation) {
   if (frame->parent())
     return; // Not a top-level navigation.
 
   NavigationState* state = NavigationState::FromDataSource(frame->dataSource());
   if (!state->was_within_same_page()) {
     // Clear "block" flags for the new page. This needs to happen before any of
-    // allowScripts(), allowImage(), allowPlugins() is called for the new page
-    // so that these functions can correctly detect that a piece of content
-    // flipped from "not blocked" to "blocked".
+    // |AllowScript()|, |AllowScriptFromSource()|, |AllowImage()|, or
+    // |AllowPlugins()| is called for the new page so that these functions can
+    // correctly detect that a piece of content flipped from "not blocked" to
+    // "blocked".
     ClearBlockedContentSettings();
     plugins_temporarily_allowed_ = false;
   }
 
   GURL url = frame->document().url();
 
   if (frame->document().securityOrigin().toString() == "null" &&
       !url.SchemeIs(chrome::kFileScheme)) {
     // The Frame has a unique security origin. Instead of granting the frame
     // privileges based on it's URL, we fall back to the default content
@@ skipping 62 matching lines @@
   return result;
 }
 
 bool ContentSettingsObserver::AllowImage(WebFrame* frame,
                                          bool enabled_per_settings,
                                          const WebURL& image_url) {
   if (IsWhitelistedForContentSettings(frame))
     return true;
 
   bool allow = enabled_per_settings;
-  const GURL& primary_url = GetOriginOrURL(frame);
-  GURL secondary_url(image_url);
-  if (image_setting_rules_ &&
+  if (content_setting_rules_ &&
       enabled_per_settings) {

[jochen (gone - plz use gerrit), 2011/11/03 15:55:09]

nit. doesn't this fit into one line?

[marja, 2011/11/03 16:28:39]

Done.

-    ContentSettingsForOneType::const_iterator it;
-    for (it = image_setting_rules_->begin();
-         it != image_setting_rules_->end(); ++it) {
-      if (it->primary_pattern.Matches(primary_url) &&
-          it->secondary_pattern.Matches(secondary_url)) {
-        allow = (it->setting != CONTENT_SETTING_BLOCK);
-        break;
-      }
-    }
+    const GURL& primary_url = GetOriginOrURL(frame);
+    GURL secondary_url(image_url);
+    allow = (GetContentSettingFromRules(
+        content_setting_rules_->image_rules,
+        primary_url, secondary_url) != CONTENT_SETTING_BLOCK);
   }
 
   if (!allow)
     DidBlockContentType(CONTENT_SETTINGS_TYPE_IMAGES, std::string());
   return allow;
 }
 
 bool ContentSettingsObserver::AllowIndexedDB(WebFrame* frame,
                                              const WebString& name,
                                              const WebSecurityOrigin& origin) {
   if (frame->document().securityOrigin().isEmpty() ||
       frame->top()->document().securityOrigin().isEmpty())
     return false; // Uninitialized document.
 
   bool result = false;
   Send(new ChromeViewHostMsg_AllowIndexedDB(
       routing_id(), GURL(frame->document().securityOrigin().toString()),
       GURL(frame->top()->document().securityOrigin().toString()),
       name, &result));
   return result;
 }
 
 bool ContentSettingsObserver::AllowPlugins(WebFrame* frame,
                                            bool enabled_per_settings) {
   return enabled_per_settings;
 }
 
 bool ContentSettingsObserver::AllowScript(WebFrame* frame,
                                           bool enabled_per_settings) {
-  if (enabled_per_settings &&
-      AllowContentType(CONTENT_SETTINGS_TYPE_JAVASCRIPT)) {
-    return true;
-  }
-
+  if (!enabled_per_settings)
+    return false;
   if (IsWhitelistedForContentSettings(frame))
     return true;
 
-  return false;  // Other protocols fall through here.
+  if (content_setting_rules_) {
+    const GURL& primary_url = GetOriginOrURL(frame);
+    GURL secondary_url(frame->document().securityOrigin().toString());
+    return (GetContentSettingFromRules(
+        content_setting_rules_->script_rules,
+        primary_url, secondary_url) != CONTENT_SETTING_BLOCK);
+  }
+  return true;
+}
+
+bool ContentSettingsObserver::AllowScriptFromSource(
+    WebFrame* frame,
+    bool enabled_per_settings,
+    const WebKit::WebURL& script_url) {
+  if (!enabled_per_settings)
+    return false;
+  if (IsWhitelistedForContentSettings(frame))
+    return true;
+
+  if (content_setting_rules_) {
+    const GURL& primary_url = GetOriginOrURL(frame);
+    GURL secondary_url(script_url);
+    return (GetContentSettingFromRules(
+        content_setting_rules_->script_rules,
+        primary_url, secondary_url) != CONTENT_SETTING_BLOCK);
+  }
+  return true;
 }
 
 bool ContentSettingsObserver::AllowStorage(WebFrame* frame, bool local) {
   if (frame->document().securityOrigin().isEmpty() ||
       frame->top()->document().securityOrigin().isEmpty())
     return false; // Uninitialized document.
   bool result = false;
 
   StoragePermissionsKey key(
       GURL(frame->document().securityOrigin().toString()), local);
@@ skipping 34 matching lines @@
   // CONTENT_SETTING_ASK is only valid for cookies.
   return current_content_settings_.settings[settings_type] !=
       CONTENT_SETTING_BLOCK;
 }
 
 void ContentSettingsObserver::ClearBlockedContentSettings() {
   for (size_t i = 0; i < arraysize(content_blocked_); ++i)
     content_blocked_[i] = false;
   cached_storage_permissions_.clear();
 }