| OLD | NEW |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "extensions/common/csp_validator.h" | 5 #include "extensions/common/csp_validator.h" |
| 6 | 6 |
| 7 #include <vector> | 7 #include <vector> |
| 8 | 8 |
| 9 #include "base/strings/string_split.h" | 9 #include "base/strings/string_split.h" |
| 10 #include "base/strings/string_tokenizer.h" | 10 #include "base/strings/string_tokenizer.h" |
| (...skipping 222 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 233 | 233 |
| 234 return policy.find_first_of(kBadChars, 0, arraysize(kBadChars)) == | 234 return policy.find_first_of(kBadChars, 0, arraysize(kBadChars)) == |
| 235 std::string::npos; | 235 std::string::npos; |
| 236 } | 236 } |
| 237 | 237 |
| 238 std::string SanitizeContentSecurityPolicy( | 238 std::string SanitizeContentSecurityPolicy( |
| 239 const std::string& policy, | 239 const std::string& policy, |
| 240 int options, | 240 int options, |
| 241 std::vector<InstallWarning>* warnings) { | 241 std::vector<InstallWarning>* warnings) { |
| 242 // See http://www.w3.org/TR/CSP/#parse-a-csp-policy for parsing algorithm. | 242 // See http://www.w3.org/TR/CSP/#parse-a-csp-policy for parsing algorithm. |
| 243 std::vector<std::string> directives = base::SplitString( | 243 std::vector<std::string> directives; |
| 244 policy, ";", base::TRIM_WHITESPACE, base::SPLIT_WANT_ALL); | 244 base::SplitString(policy, ';', &directives); |
| 245 | 245 |
| 246 DirectiveStatus default_src_status(kDefaultSrc); | 246 DirectiveStatus default_src_status(kDefaultSrc); |
| 247 DirectiveStatus script_src_status(kScriptSrc); | 247 DirectiveStatus script_src_status(kScriptSrc); |
| 248 DirectiveStatus object_src_status(kObjectSrc); | 248 DirectiveStatus object_src_status(kObjectSrc); |
| 249 | 249 |
| 250 bool allow_insecure_object_src = | 250 bool allow_insecure_object_src = |
| 251 AllowedToHaveInsecureObjectSrc(options, directives); | 251 AllowedToHaveInsecureObjectSrc(options, directives); |
| 252 | 252 |
| 253 std::vector<std::string> sane_csp_parts; | 253 std::vector<std::string> sane_csp_parts; |
| 254 std::vector<InstallWarning> default_src_csp_warnings; | 254 std::vector<InstallWarning> default_src_csp_warnings; |
| (...skipping 45 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 300 manifest_errors::kInvalidCSPMissingSecureSrc, kObjectSrc))); | 300 manifest_errors::kInvalidCSPMissingSecureSrc, kObjectSrc))); |
| 301 } | 301 } |
| 302 } | 302 } |
| 303 | 303 |
| 304 return base::JoinString(sane_csp_parts, " "); | 304 return base::JoinString(sane_csp_parts, " "); |
| 305 } | 305 } |
| 306 | 306 |
| 307 bool ContentSecurityPolicyIsSandboxed( | 307 bool ContentSecurityPolicyIsSandboxed( |
| 308 const std::string& policy, Manifest::Type type) { | 308 const std::string& policy, Manifest::Type type) { |
| 309 // See http://www.w3.org/TR/CSP/#parse-a-csp-policy for parsing algorithm. | 309 // See http://www.w3.org/TR/CSP/#parse-a-csp-policy for parsing algorithm. |
| 310 std::vector<std::string> directives; |
| 311 base::SplitString(policy, ';', &directives); |
| 312 |
| 310 bool seen_sandbox = false; | 313 bool seen_sandbox = false; |
| 311 for (const std::string& input : base::SplitString( | 314 |
| 312 policy, ";", base::TRIM_WHITESPACE, base::SPLIT_WANT_ALL)) { | 315 for (size_t i = 0; i < directives.size(); ++i) { |
| 316 std::string& input = directives[i]; |
| 313 base::StringTokenizer tokenizer(input, " \t\r\n"); | 317 base::StringTokenizer tokenizer(input, " \t\r\n"); |
| 314 if (!tokenizer.GetNext()) | 318 if (!tokenizer.GetNext()) |
| 315 continue; | 319 continue; |
| 316 | 320 |
| 317 std::string directive_name = tokenizer.token(); | 321 std::string directive_name = tokenizer.token(); |
| 318 base::StringToLowerASCII(&directive_name); | 322 base::StringToLowerASCII(&directive_name); |
| 319 | 323 |
| 320 if (directive_name != kSandboxDirectiveName) | 324 if (directive_name != kSandboxDirectiveName) |
| 321 continue; | 325 continue; |
| 322 | 326 |
| (...skipping 14 matching lines...) Expand all Loading... |
| 337 } | 341 } |
| 338 } | 342 } |
| 339 } | 343 } |
| 340 | 344 |
| 341 return seen_sandbox; | 345 return seen_sandbox; |
| 342 } | 346 } |
| 343 | 347 |
| 344 } // namespace csp_validator | 348 } // namespace csp_validator |
| 345 | 349 |
| 346 } // namespace extensions | 350 } // namespace extensions |
| OLD | NEW |