Add --csp flag to test.dart.

tools/testing/dart/http_server.dart

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 library http_server;
 
 import 'dart:async';
 import 'dart:io';
 import 'dart:isolate';
 import 'dart:uri';
 import 'test_suite.dart';  // For TestUtils.
 // TODO(efortuna): Rewrite to not use the args library and simply take an
 // expected number of arguments, so test.dart doesn't rely on the args library?
 // See discussion on https://codereview.chromium.org/11931025/.
 import 'vendored_pkg/args/args.dart';
 import 'utils.dart';
 
 
 /// Interface of the HTTP server:
 ///
-/// /echo: This will stream the data received in the request stream back 
+/// /echo: This will stream the data received in the request stream back
 ///        to the client.
 /// /root_dart/X: This will serve the corresponding file from the dart
 ///               directory (i.e. '$DartDirectory/X').
 /// /root_build/X: This will serve the corresponding file from the build
 ///                directory (i.e. '$BuildDirectory/X').
 /// /FOO/packages/BAR: This will serve the corresponding file from the packages
 ///                    directory (i.e. '$BuildDirectory/packages/BAR')
 ///
 /// In case a path does not refer to a file but rather to a directory, a
 /// directory listing will be displayed.
@@ skipping 12 matching lines @@
       help: 'The main server port we wish to respond to requests.',
       defaultsTo: '0');
   parser.addOption('crossOriginPort', abbr: 'c',
       help: 'A different port that accepts request from the main server port.',
       defaultsTo: '0');
   parser.addFlag('help', abbr: 'h', negatable: false,
       help: 'Print this usage information.');
   parser.addOption('build-directory', help: 'The build directory to use.');
   parser.addOption('network', help: 'The network interface to use.',
       defaultsTo: '127.0.0.1');
+  parser.addFlag('csp', help: 'Use Content Security Policy restrictions.',
+      defaultsTo: false);
   var args = parser.parse(new Options().arguments);
   if (args['help']) {
     print(parser.getUsage());
   } else {
     // Pretend we're running test.dart so that TestUtils doesn't get confused
     // about the "current directory." This is only used if we're trying to run
     // this file independently for local testing.
     TestUtils.testScriptPath = new Path(new Options().script)
         .directoryPath
         .join(new Path('../../test.dart'))
         .canonicalize()
         .toNativePath();
-    var servers = new TestingServers(new Path(args['build-directory']));
+    var servers = new TestingServers(new Path(args['build-directory']),
+                                     args['csp']);
     var port = int.parse(args['port']);
     var crossOriginPort = int.parse(args['crossOriginPort']);
     servers.startServers(args['network'],
                          port: port,
                          crossOriginPort: crossOriginPort);
     DebugLogger.info('Server listening on port ${servers.port}');
     DebugLogger.info('Server listening on port ${servers.crossOriginPort}');
   }
 }
 
 /**
  * Runs a set of servers that are initialized specifically for the needs of our
  * test framework, such as dealing with package-root.
  */
 class TestingServers {
   List _serverList = [];
   Path _buildDirectory = null;
+  final bool useContentSecurityPolicy;
 
-  TestingServers(Path buildDirectory) {
+  TestingServers(Path buildDirectory, this.useContentSecurityPolicy) {
     _buildDirectory = TestUtils.absolutePath(buildDirectory);
   }
 
   int get port => _serverList[0].port;
   int get crossOriginPort => _serverList[1].port;
 
   /**
    * [startServers] will start two Http servers.
    * The first server listens on [port] and sets
    *   "Access-Control-Allow-Origin: *"
    * The second server listens on [crossOriginPort] and sets
    *   "Access-Control-Allow-Origin: client:port1
    *   "Access-Control-Allow-Credentials: true"
    */
   void startServers(String host, {int port: 0, int crossOriginPort: 0}) {
     _startHttpServer(host, port: port);
     _startHttpServer(host,
                      port: crossOriginPort,
                      allowedPort:_serverList[0].port);
   }
 
   String httpServerCommandline() {
     var dart = TestUtils.dartTestExecutable.toNativePath();
     var dartDir = TestUtils.dartDir();
     var script = dartDir.join(new Path("tools/testing/dart/http_server.dart"));
     var buildDirectory = _buildDirectory.toNativePath();
+    var csp = useContentSecurityPolicy ? '--csp ' : '';
 
-    return '$dart $script -p $port -c $crossOriginPort '
+    return '$dart $script -p $port -c $crossOriginPort $csp'
            '--build-directory=$buildDirectory';
   }
 
   void stopServers() {
     for (var server in _serverList) {
       server.close();
     }
   }
 
   void _startHttpServer(String host, {int port: 0, int allowedPort: -1}) {
@@ skipping 143 matching lines @@
       // Allow loading from http://*:$allowedPort in browsers.
       var allowedOrigin =
           '${origin.scheme}://${origin.domain}:${allowedPort}';
       response.headers.set("Access-Control-Allow-Origin", allowedOrigin);
       response.headers.set('Access-Control-Allow-Credentials', 'true');
     } else {
       // No allowedPort specified. Allow from anywhere (but cross-origin
       // requests *with credentials* will fail because you can't use "*").
       response.headers.set("Access-Control-Allow-Origin", "*");
     }
+    if (useContentSecurityPolicy) {
+      // Chrome respects the standardized Content-Security-Policy header, but

[ricow1, 2013/02/28 08:36:07]

but whereas -> whereas

+      // whereas Firefox and IE10 use X-Content-Security-Policy. Safari still
+      // uses the WebKit- prefixed version.
+      for (var header in ["Content-Security-Policy",
+                          "X-Content-Security-Policy",
+                          "X-WebKit-CSP"]) {
+        response.headers.set(header, "script-src 'self'; object-src 'self'");
+      }
+    }
     if (path.filename.endsWith('.html')) {
       response.headers.set('Content-Type', 'text/html');
     } else if (path.filename.endsWith('.js')) {
       response.headers.set('Content-Type', 'application/javascript');
     } else if (path.filename.endsWith('.dart')) {
       response.headers.set('Content-Type', 'application/dart');
     }
     file.openInputStream().pipe(response.outputStream);
   }
 
@@ skipping 21 matching lines @@
 class _Entry {
   final String name;
   final String displayName;
 
   _Entry(this.name, this.displayName);
 
   int compareTo(_Entry other) {
     return name.compareTo(other.name);
   }
 }