| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef CHROME_COMMON_EXTENSIONS_CSP_VALIDATOR_H_ | 5 #ifndef CHROME_COMMON_EXTENSIONS_CSP_VALIDATOR_H_ |
| 6 #define CHROME_COMMON_EXTENSIONS_CSP_VALIDATOR_H_ | 6 #define CHROME_COMMON_EXTENSIONS_CSP_VALIDATOR_H_ |
| 7 | 7 |
| 8 #include <string> | 8 #include <string> |
| 9 | 9 |
| 10 #include "chrome/common/extensions/extension.h" | 10 #include "chrome/common/extensions/extension.h" |
| 11 #include "chrome/common/extensions/manifest.h" |
| 11 | 12 |
| 12 namespace extensions { | 13 namespace extensions { |
| 13 | 14 |
| 14 namespace csp_validator { | 15 namespace csp_validator { |
| 15 | 16 |
| 16 // Checks whether the given |policy| is legal for use in the extension system. | 17 // Checks whether the given |policy| is legal for use in the extension system. |
| 17 // This check just ensures that the policy doesn't contain any characters that | 18 // This check just ensures that the policy doesn't contain any characters that |
| 18 // will cause problems when we transmit the policy in an HTTP header. | 19 // will cause problems when we transmit the policy in an HTTP header. |
| 19 bool ContentSecurityPolicyIsLegal(const std::string& policy); | 20 bool ContentSecurityPolicyIsLegal(const std::string& policy); |
| 20 | 21 |
| 21 // Checks whether the given |policy| meets the minimum security requirements | 22 // Checks whether the given |policy| meets the minimum security requirements |
| 22 // for use in the extension system. | 23 // for use in the extension system. |
| 23 // | 24 // |
| 24 // Ideally, we would like to say that an XSS vulnerability in the extension | 25 // Ideally, we would like to say that an XSS vulnerability in the extension |
| 25 // should not be able to execute script, even in the precense of an active | 26 // should not be able to execute script, even in the precense of an active |
| 26 // network attacker. | 27 // network attacker. |
| 27 // | 28 // |
| 28 // However, we found that it broke too many deployed extensions to limit | 29 // However, we found that it broke too many deployed extensions to limit |
| 29 // 'unsafe-eval' in the script-src directive, so that is allowed as a special | 30 // 'unsafe-eval' in the script-src directive, so that is allowed as a special |
| 30 // case for extensions. Platform apps disallow it. | 31 // case for extensions. Platform apps disallow it. |
| 31 bool ContentSecurityPolicyIsSecure( | 32 bool ContentSecurityPolicyIsSecure( |
| 32 const std::string& policy, Extension::Type type); | 33 const std::string& policy, Manifest::Type type); |
| 33 | 34 |
| 34 // Checks whether the given |policy| enforces a unique origin sandbox as | 35 // Checks whether the given |policy| enforces a unique origin sandbox as |
| 35 // defined by http://www.whatwg.org/specs/web-apps/current-work/multipage/ | 36 // defined by http://www.whatwg.org/specs/web-apps/current-work/multipage/ |
| 36 // the-iframe-element.html#attr-iframe-sandbox. The policy must have the | 37 // the-iframe-element.html#attr-iframe-sandbox. The policy must have the |
| 37 // "sandbox" directive, and the sandbox tokens must not include | 38 // "sandbox" directive, and the sandbox tokens must not include |
| 38 // "allow-same-origin". Additional restrictions may be imposed depending on | 39 // "allow-same-origin". Additional restrictions may be imposed depending on |
| 39 // |type|. | 40 // |type|. |
| 40 bool ContentSecurityPolicyIsSandboxed( | 41 bool ContentSecurityPolicyIsSandboxed( |
| 41 const std::string& policy, Extension::Type type); | 42 const std::string& policy, Manifest::Type type); |
| 42 | 43 |
| 43 } // namespace csp_validator | 44 } // namespace csp_validator |
| 44 | 45 |
| 45 } // namespace extensions | 46 } // namespace extensions |
| 46 | 47 |
| 47 #endif // CHROME_COMMON_EXTENSIONS_CSP_VALIDATOR_H_ | 48 #endif // CHROME_COMMON_EXTENSIONS_CSP_VALIDATOR_H_ |
| OLD | NEW |