OLD | NEW |
1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "extensions/common/csp_validator.h" | 5 #include "extensions/common/csp_validator.h" |
6 | 6 |
7 #include <vector> | 7 #include <vector> |
8 | 8 |
9 #include "base/strings/string_split.h" | 9 #include "base/strings/string_split.h" |
10 #include "base/strings/string_tokenizer.h" | 10 #include "base/strings/string_tokenizer.h" |
(...skipping 222 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
233 | 233 |
234 return policy.find_first_of(kBadChars, 0, arraysize(kBadChars)) == | 234 return policy.find_first_of(kBadChars, 0, arraysize(kBadChars)) == |
235 std::string::npos; | 235 std::string::npos; |
236 } | 236 } |
237 | 237 |
238 std::string SanitizeContentSecurityPolicy( | 238 std::string SanitizeContentSecurityPolicy( |
239 const std::string& policy, | 239 const std::string& policy, |
240 int options, | 240 int options, |
241 std::vector<InstallWarning>* warnings) { | 241 std::vector<InstallWarning>* warnings) { |
242 // See http://www.w3.org/TR/CSP/#parse-a-csp-policy for parsing algorithm. | 242 // See http://www.w3.org/TR/CSP/#parse-a-csp-policy for parsing algorithm. |
243 std::vector<std::string> directives = base::SplitString( | 243 std::vector<std::string> directives; |
244 policy, ";", base::TRIM_WHITESPACE, base::SPLIT_WANT_ALL); | 244 base::SplitString(policy, ';', &directives); |
245 | 245 |
246 DirectiveStatus default_src_status(kDefaultSrc); | 246 DirectiveStatus default_src_status(kDefaultSrc); |
247 DirectiveStatus script_src_status(kScriptSrc); | 247 DirectiveStatus script_src_status(kScriptSrc); |
248 DirectiveStatus object_src_status(kObjectSrc); | 248 DirectiveStatus object_src_status(kObjectSrc); |
249 | 249 |
250 bool allow_insecure_object_src = | 250 bool allow_insecure_object_src = |
251 AllowedToHaveInsecureObjectSrc(options, directives); | 251 AllowedToHaveInsecureObjectSrc(options, directives); |
252 | 252 |
253 std::vector<std::string> sane_csp_parts; | 253 std::vector<std::string> sane_csp_parts; |
254 std::vector<InstallWarning> default_src_csp_warnings; | 254 std::vector<InstallWarning> default_src_csp_warnings; |
(...skipping 45 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
300 manifest_errors::kInvalidCSPMissingSecureSrc, kObjectSrc))); | 300 manifest_errors::kInvalidCSPMissingSecureSrc, kObjectSrc))); |
301 } | 301 } |
302 } | 302 } |
303 | 303 |
304 return base::JoinString(sane_csp_parts, " "); | 304 return base::JoinString(sane_csp_parts, " "); |
305 } | 305 } |
306 | 306 |
307 bool ContentSecurityPolicyIsSandboxed( | 307 bool ContentSecurityPolicyIsSandboxed( |
308 const std::string& policy, Manifest::Type type) { | 308 const std::string& policy, Manifest::Type type) { |
309 // See http://www.w3.org/TR/CSP/#parse-a-csp-policy for parsing algorithm. | 309 // See http://www.w3.org/TR/CSP/#parse-a-csp-policy for parsing algorithm. |
| 310 std::vector<std::string> directives; |
| 311 base::SplitString(policy, ';', &directives); |
| 312 |
310 bool seen_sandbox = false; | 313 bool seen_sandbox = false; |
311 for (const std::string& input : base::SplitString( | 314 |
312 policy, ";", base::TRIM_WHITESPACE, base::SPLIT_WANT_ALL)) { | 315 for (size_t i = 0; i < directives.size(); ++i) { |
| 316 std::string& input = directives[i]; |
313 base::StringTokenizer tokenizer(input, " \t\r\n"); | 317 base::StringTokenizer tokenizer(input, " \t\r\n"); |
314 if (!tokenizer.GetNext()) | 318 if (!tokenizer.GetNext()) |
315 continue; | 319 continue; |
316 | 320 |
317 std::string directive_name = tokenizer.token(); | 321 std::string directive_name = tokenizer.token(); |
318 base::StringToLowerASCII(&directive_name); | 322 base::StringToLowerASCII(&directive_name); |
319 | 323 |
320 if (directive_name != kSandboxDirectiveName) | 324 if (directive_name != kSandboxDirectiveName) |
321 continue; | 325 continue; |
322 | 326 |
(...skipping 14 matching lines...) Expand all Loading... |
337 } | 341 } |
338 } | 342 } |
339 } | 343 } |
340 | 344 |
341 return seen_sandbox; | 345 return seen_sandbox; |
342 } | 346 } |
343 | 347 |
344 } // namespace csp_validator | 348 } // namespace csp_validator |
345 | 349 |
346 } // namespace extensions | 350 } // namespace extensions |
OLD | NEW |