| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright (C) 2011 Adam Barth. All Rights Reserved. | 2 * Copyright (C) 2011 Adam Barth. All Rights Reserved. |
| 3 * Copyright (C) 2011 Daniel Bates (dbates@intudata.com). | 3 * Copyright (C) 2011 Daniel Bates (dbates@intudata.com). |
| 4 * | 4 * |
| 5 * Redistribution and use in source and binary forms, with or without | 5 * Redistribution and use in source and binary forms, with or without |
| 6 * modification, are permitted provided that the following conditions | 6 * modification, are permitted provided that the following conditions |
| 7 * are met: | 7 * are met: |
| 8 * 1. Redistributions of source code must retain the above copyright | 8 * 1. Redistributions of source code must retain the above copyright |
| 9 * notice, this list of conditions and the following disclaimer. | 9 * notice, this list of conditions and the following disclaimer. |
| 10 * 2. Redistributions in binary form must reproduce the above copyright | 10 * 2. Redistributions in binary form must reproduce the above copyright |
| (...skipping 245 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 256 | 256 |
| 257 if (document->encoding().isValid()) | 257 if (document->encoding().isValid()) |
| 258 m_encoding = document->encoding(); | 258 m_encoding = document->encoding(); |
| 259 | 259 |
| 260 m_decodedURL = fullyDecodeString(m_documentURL.string(), m_encoding); | 260 m_decodedURL = fullyDecodeString(m_documentURL.string(), m_encoding); |
| 261 if (m_decodedURL.find(isRequiredForInjection) == kNotFound) | 261 if (m_decodedURL.find(isRequiredForInjection) == kNotFound) |
| 262 m_decodedURL = String(); | 262 m_decodedURL = String(); |
| 263 | 263 |
| 264 String httpBodyAsString; | 264 String httpBodyAsString; |
| 265 if (DocumentLoader* documentLoader = document->frame()->loader().documentLoa
der()) { | 265 if (DocumentLoader* documentLoader = document->frame()->loader().documentLoa
der()) { |
| 266 DEFINE_STATIC_LOCAL(String, XSSProtectionHeader, ("X-XSS-Protection")); | 266 DEFINE_STATIC_LOCAL(const AtomicString, XSSProtectionHeader, ("X-XSS-Pro
tection", AtomicString::ConstructFromLiteral)); |
| 267 String headerValue = documentLoader->response().httpHeaderField(XSSProte
ctionHeader); | 267 const AtomicString& headerValue = documentLoader->response().httpHeaderF
ield(XSSProtectionHeader); |
| 268 String errorDetails; | 268 String errorDetails; |
| 269 unsigned errorPosition = 0; | 269 unsigned errorPosition = 0; |
| 270 String reportURL; | 270 String reportURL; |
| 271 KURL xssProtectionReportURL; | 271 KURL xssProtectionReportURL; |
| 272 | 272 |
| 273 // Process the X-XSS-Protection header, then mix in the CSP header's val
ue. | 273 // Process the X-XSS-Protection header, then mix in the CSP header's val
ue. |
| 274 ReflectedXSSDisposition xssProtectionHeader = parseXSSProtectionHeader(h
eaderValue, errorDetails, errorPosition, reportURL); | 274 ReflectedXSSDisposition xssProtectionHeader = parseXSSProtectionHeader(h
eaderValue, errorDetails, errorPosition, reportURL); |
| 275 m_didSendValidXSSProtectionHeader = xssProtectionHeader != ReflectedXSSU
nset && xssProtectionHeader != ReflectedXSSInvalid; | 275 m_didSendValidXSSProtectionHeader = xssProtectionHeader != ReflectedXSSU
nset && xssProtectionHeader != ReflectedXSSInvalid; |
| 276 if ((xssProtectionHeader == FilterReflectedXSS || xssProtectionHeader ==
BlockReflectedXSS) && !reportURL.isEmpty()) { | 276 if ((xssProtectionHeader == FilterReflectedXSS || xssProtectionHeader ==
BlockReflectedXSS) && !reportURL.isEmpty()) { |
| 277 xssProtectionReportURL = document->completeURL(reportURL); | 277 xssProtectionReportURL = document->completeURL(reportURL); |
| (...skipping 444 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 722 } | 722 } |
| 723 | 723 |
| 724 bool XSSAuditor::isSafeToSendToAnotherThread() const | 724 bool XSSAuditor::isSafeToSendToAnotherThread() const |
| 725 { | 725 { |
| 726 return m_documentURL.isSafeToSendToAnotherThread() | 726 return m_documentURL.isSafeToSendToAnotherThread() |
| 727 && m_decodedURL.isSafeToSendToAnotherThread() | 727 && m_decodedURL.isSafeToSendToAnotherThread() |
| 728 && m_decodedHTTPBody.isSafeToSendToAnotherThread(); | 728 && m_decodedHTTPBody.isSafeToSendToAnotherThread(); |
| 729 } | 729 } |
| 730 | 730 |
| 731 } // namespace WebCore | 731 } // namespace WebCore |
| OLD | NEW |