OLD | NEW |
1 /* | 1 /* |
2 * Copyright (C) 2011 Adam Barth. All Rights Reserved. | 2 * Copyright (C) 2011 Adam Barth. All Rights Reserved. |
3 * Copyright (C) 2011 Daniel Bates (dbates@intudata.com). | 3 * Copyright (C) 2011 Daniel Bates (dbates@intudata.com). |
4 * | 4 * |
5 * Redistribution and use in source and binary forms, with or without | 5 * Redistribution and use in source and binary forms, with or without |
6 * modification, are permitted provided that the following conditions | 6 * modification, are permitted provided that the following conditions |
7 * are met: | 7 * are met: |
8 * 1. Redistributions of source code must retain the above copyright | 8 * 1. Redistributions of source code must retain the above copyright |
9 * notice, this list of conditions and the following disclaimer. | 9 * notice, this list of conditions and the following disclaimer. |
10 * 2. Redistributions in binary form must reproduce the above copyright | 10 * 2. Redistributions in binary form must reproduce the above copyright |
(...skipping 245 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
256 | 256 |
257 if (document->encoding().isValid()) | 257 if (document->encoding().isValid()) |
258 m_encoding = document->encoding(); | 258 m_encoding = document->encoding(); |
259 | 259 |
260 m_decodedURL = fullyDecodeString(m_documentURL.string(), m_encoding); | 260 m_decodedURL = fullyDecodeString(m_documentURL.string(), m_encoding); |
261 if (m_decodedURL.find(isRequiredForInjection) == kNotFound) | 261 if (m_decodedURL.find(isRequiredForInjection) == kNotFound) |
262 m_decodedURL = String(); | 262 m_decodedURL = String(); |
263 | 263 |
264 String httpBodyAsString; | 264 String httpBodyAsString; |
265 if (DocumentLoader* documentLoader = document->frame()->loader().documentLoa
der()) { | 265 if (DocumentLoader* documentLoader = document->frame()->loader().documentLoa
der()) { |
266 DEFINE_STATIC_LOCAL(String, XSSProtectionHeader, ("X-XSS-Protection")); | 266 DEFINE_STATIC_LOCAL(const AtomicString, XSSProtectionHeader, ("X-XSS-Pro
tection", AtomicString::ConstructFromLiteral)); |
267 String headerValue = documentLoader->response().httpHeaderField(XSSProte
ctionHeader); | 267 const AtomicString& headerValue = documentLoader->response().httpHeaderF
ield(XSSProtectionHeader); |
268 String errorDetails; | 268 String errorDetails; |
269 unsigned errorPosition = 0; | 269 unsigned errorPosition = 0; |
270 String reportURL; | 270 String reportURL; |
271 KURL xssProtectionReportURL; | 271 KURL xssProtectionReportURL; |
272 | 272 |
273 // Process the X-XSS-Protection header, then mix in the CSP header's val
ue. | 273 // Process the X-XSS-Protection header, then mix in the CSP header's val
ue. |
274 ReflectedXSSDisposition xssProtectionHeader = parseXSSProtectionHeader(h
eaderValue, errorDetails, errorPosition, reportURL); | 274 ReflectedXSSDisposition xssProtectionHeader = parseXSSProtectionHeader(h
eaderValue, errorDetails, errorPosition, reportURL); |
275 m_didSendValidXSSProtectionHeader = xssProtectionHeader != ReflectedXSSU
nset && xssProtectionHeader != ReflectedXSSInvalid; | 275 m_didSendValidXSSProtectionHeader = xssProtectionHeader != ReflectedXSSU
nset && xssProtectionHeader != ReflectedXSSInvalid; |
276 if ((xssProtectionHeader == FilterReflectedXSS || xssProtectionHeader ==
BlockReflectedXSS) && !reportURL.isEmpty()) { | 276 if ((xssProtectionHeader == FilterReflectedXSS || xssProtectionHeader ==
BlockReflectedXSS) && !reportURL.isEmpty()) { |
277 xssProtectionReportURL = document->completeURL(reportURL); | 277 xssProtectionReportURL = document->completeURL(reportURL); |
(...skipping 444 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
722 } | 722 } |
723 | 723 |
724 bool XSSAuditor::isSafeToSendToAnotherThread() const | 724 bool XSSAuditor::isSafeToSendToAnotherThread() const |
725 { | 725 { |
726 return m_documentURL.isSafeToSendToAnotherThread() | 726 return m_documentURL.isSafeToSendToAnotherThread() |
727 && m_decodedURL.isSafeToSendToAnotherThread() | 727 && m_decodedURL.isSafeToSendToAnotherThread() |
728 && m_decodedHTTPBody.isSafeToSendToAnotherThread(); | 728 && m_decodedHTTPBody.isSafeToSendToAnotherThread(); |
729 } | 729 } |
730 | 730 |
731 } // namespace WebCore | 731 } // namespace WebCore |
OLD | NEW |