Take script URLs into account when applying script content settings.

chrome/renderer/content_settings_observer.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_RENDERER_CONTENT_SETTINGS_OBSERVER_H_
 #define CHROME_RENDERER_CONTENT_SETTINGS_OBSERVER_H_
 #pragma once
 
 #include <map>
 
@@ skipping 16 matching lines @@
   explicit ContentSettingsObserver(content::RenderView* render_view);
   virtual ~ContentSettingsObserver();
 
   // Sets the content settings that back allowScripts() and allowPlugins().
   void SetContentSettings(const ContentSettings& settings);
 
   // Sets the default content settings that back allowScripts() and
   // allowPlugins().
   void SetDefaultContentSettings(const ContentSettings* settings);
 
-  // Sets the image setting rules which back |allowImage()|. The
-  // |ContentSettingsForOneType| object must outlive this
+  // Sets the content setting rules which back |AllowImage()|, |AllowScript()|,
+  // and |AllowScriptFromSource()|. |content_setting_rules| must outlive this
   // |ContentSettingsObserver|.
-  void SetImageSettingRules(
-      const ContentSettingsForOneType* image_setting_rules);
+  void SetContentSettingRules(
+      const RendererContentSettingRules* content_setting_rules);
 
   // Returns the setting for the given type.
   ContentSetting GetContentSetting(ContentSettingsType type);
 
   bool plugins_temporarily_allowed() {
     return plugins_temporarily_allowed_;
   }
 
   // Sends an IPC notification that the specified content type was blocked.
   // If the content type requires it, |resource_identifier| names the specific
   // resource that was blocked (the plugin path in the case of plugins),
   // otherwise it's the empty string.
   void DidBlockContentType(ContentSettingsType settings_type,
                            const std::string& resource_identifier);
 
   // These correspond to WebKit::WebPermissionClient methods.
   bool AllowDatabase(WebKit::WebFrame* frame,
                      const WebKit::WebString& name,
                      const WebKit::WebString& display_name,
                      unsigned long estimated_size);
   bool AllowFileSystem(WebKit::WebFrame* frame);
   bool AllowImage(WebKit::WebFrame* frame,
                   bool enabled_per_settings,
                   const WebKit::WebURL& image_url);
   bool AllowIndexedDB(WebKit::WebFrame* frame,
                       const WebKit::WebString& name,
                       const WebKit::WebSecurityOrigin& origin);
   bool AllowPlugins(WebKit::WebFrame* frame, bool enabled_per_settings);
   bool AllowScript(WebKit::WebFrame* frame, bool enabled_per_settings);
+  bool AllowScriptFromSource(WebKit::WebFrame* frame, bool enabled_per_settings,
+                             const WebKit::WebURL& script_url);
   bool AllowStorage(WebKit::WebFrame* frame, bool local);
   void DidNotAllowPlugins(WebKit::WebFrame* frame);
   void DidNotAllowScript(WebKit::WebFrame* frame);
 
  private:
   // RenderViewObserver implementation.
   virtual bool OnMessageReceived(const IPC::Message& message);
   virtual void DidCommitProvisionalLoad(WebKit::WebFrame* frame,
                                         bool is_new_navigation);
 
@@ skipping 11 matching lines @@
   void ClearBlockedContentSettings();
 
   typedef std::map<GURL, ContentSettings> HostContentSettings;
   HostContentSettings host_content_settings_;
 
   // A pointer to the most up-to-date view of the default content
   // settings. Normally, they are owned by |ChromeRenderProcessObserver|. In the
   // tests they are owned by the caller of |SetDefaultContentSettings|.
   const ContentSettings* default_content_settings_;
 
   // Stores if loading of scripts and plugins is allowed.

[Bernhard Bauer, 2011/11/08 09:32:52]

This comment is not accurate anymore. In fact, I think the whole ContentSettings
struct isn't needed anymore! :) You can remove it in another CL though if you
want.

[marja, 2011/11/08 09:39:35]

Ahh, true, I'll create another CL for removing this and other unnecessary things
from ContentSettingsObserver.

   ContentSettings current_content_settings_;
 
-  // Stores the rules for image content settings. Normally, they are owned by
-  // |ChromeRenderProcessObserver|. In the tests they are owned by the caller of
-  // |SetImageSettingRules|.
-  const ContentSettingsForOneType* image_setting_rules_;
+  // A pointer to content setting rules stored by the renderer. Normally, the
+  // |RendererContentSettingRules| object is owned by
+  // |ChromeRenderProcessObserver|. In the tests it is owned by the caller of
+  // |SetContentSettingRules|.
+  const RendererContentSettingRules* content_setting_rules_;
 
   // Stores if images, scripts, and plugins have actually been blocked.
   bool content_blocked_[CONTENT_SETTINGS_NUM_TYPES];
 
   // Caches the result of AllowStorage.
   typedef std::pair<GURL, bool> StoragePermissionsKey;
   std::map<StoragePermissionsKey, bool> cached_storage_permissions_;
 
   bool plugins_temporarily_allowed_;
 
   DISALLOW_COPY_AND_ASSIGN(ContentSettingsObserver);
 };
 
 #endif  // CHROME_RENDERER_CONTENT_SETTINGS_OBSERVER_H_