| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright (C) 2011 Adam Barth. All Rights Reserved. | 2 * Copyright (C) 2011 Adam Barth. All Rights Reserved. |
| 3 * Copyright (C) 2011 Daniel Bates (dbates@intudata.com). | 3 * Copyright (C) 2011 Daniel Bates (dbates@intudata.com). |
| 4 * | 4 * |
| 5 * Redistribution and use in source and binary forms, with or without | 5 * Redistribution and use in source and binary forms, with or without |
| 6 * modification, are permitted provided that the following conditions | 6 * modification, are permitted provided that the following conditions |
| 7 * are met: | 7 * are met: |
| 8 * 1. Redistributions of source code must retain the above copyright | 8 * 1. Redistributions of source code must retain the above copyright |
| 9 * notice, this list of conditions and the following disclaimer. | 9 * notice, this list of conditions and the following disclaimer. |
| 10 * 2. Redistributions in binary form must reproduce the above copyright | 10 * 2. Redistributions in binary form must reproduce the above copyright |
| (...skipping 26 matching lines...) Expand all Loading... |
| 37 #include "core/html/HTMLParamElement.h" | 37 #include "core/html/HTMLParamElement.h" |
| 38 #include "core/html/LinkRelAttribute.h" | 38 #include "core/html/LinkRelAttribute.h" |
| 39 #include "core/html/parser/HTMLDocumentParser.h" | 39 #include "core/html/parser/HTMLDocumentParser.h" |
| 40 #include "core/html/parser/HTMLParserIdioms.h" | 40 #include "core/html/parser/HTMLParserIdioms.h" |
| 41 #include "core/html/parser/TextResourceDecoder.h" | 41 #include "core/html/parser/TextResourceDecoder.h" |
| 42 #include "core/html/parser/XSSAuditorDelegate.h" | 42 #include "core/html/parser/XSSAuditorDelegate.h" |
| 43 #include "core/inspector/ConsoleMessage.h" | 43 #include "core/inspector/ConsoleMessage.h" |
| 44 #include "core/loader/DocumentLoader.h" | 44 #include "core/loader/DocumentLoader.h" |
| 45 #include "core/loader/MixedContentChecker.h" | 45 #include "core/loader/MixedContentChecker.h" |
| 46 #include "platform/JSONValues.h" | 46 #include "platform/JSONValues.h" |
| 47 #include "platform/network/FormData.h" | 47 #include "platform/network/EncodedFormData.h" |
| 48 #include "platform/text/DecodeEscapeSequences.h" | 48 #include "platform/text/DecodeEscapeSequences.h" |
| 49 #include "wtf/ASCIICType.h" | 49 #include "wtf/ASCIICType.h" |
| 50 #include "wtf/MainThread.h" | 50 #include "wtf/MainThread.h" |
| 51 | 51 |
| 52 namespace { | 52 namespace { |
| 53 | 53 |
| 54 // SecurityOrigin::urlWithUniqueSecurityOrigin() can't be used cross-thread, or
we'd use it instead. | 54 // SecurityOrigin::urlWithUniqueSecurityOrigin() can't be used cross-thread, or
we'd use it instead. |
| 55 const char kURLWithUniqueOrigin[] = "data:,"; | 55 const char kURLWithUniqueOrigin[] = "data:,"; |
| 56 | 56 |
| 57 const char kSafeJavaScriptURL[] = "javascript:void(0)"; | 57 const char kSafeJavaScriptURL[] = "javascript:void(0)"; |
| (...skipping 295 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 353 document->addConsoleMessage(ConsoleMessage::create(SecurityMessageSo
urce, ErrorMessageLevel, "Error parsing header X-XSS-Protection: " + headerValue
+ ": " + errorDetails + " at character position " + String::format("%u", error
Position) + ". The default protections will be applied.")); | 353 document->addConsoleMessage(ConsoleMessage::create(SecurityMessageSo
urce, ErrorMessageLevel, "Error parsing header X-XSS-Protection: " + headerValue
+ ": " + errorDetails + " at character position " + String::format("%u", error
Position) + ". The default protections will be applied.")); |
| 354 | 354 |
| 355 ReflectedXSSDisposition cspHeader = document->contentSecurityPolicy()->r
eflectedXSSDisposition(); | 355 ReflectedXSSDisposition cspHeader = document->contentSecurityPolicy()->r
eflectedXSSDisposition(); |
| 356 m_didSendValidCSPHeader = cspHeader != ReflectedXSSUnset && cspHeader !=
ReflectedXSSInvalid; | 356 m_didSendValidCSPHeader = cspHeader != ReflectedXSSUnset && cspHeader !=
ReflectedXSSInvalid; |
| 357 | 357 |
| 358 m_xssProtection = combineXSSProtectionHeaderAndCSP(xssProtectionHeader,
cspHeader); | 358 m_xssProtection = combineXSSProtectionHeaderAndCSP(xssProtectionHeader,
cspHeader); |
| 359 // FIXME: Combine the two report URLs in some reasonable way. | 359 // FIXME: Combine the two report URLs in some reasonable way. |
| 360 if (auditorDelegate) | 360 if (auditorDelegate) |
| 361 auditorDelegate->setReportURL(xssProtectionReportURL.copy()); | 361 auditorDelegate->setReportURL(xssProtectionReportURL.copy()); |
| 362 | 362 |
| 363 FormData* httpBody = documentLoader->request().httpBody(); | 363 EncodedFormData* httpBody = documentLoader->request().httpBody(); |
| 364 if (httpBody && !httpBody->isEmpty()) | 364 if (httpBody && !httpBody->isEmpty()) |
| 365 m_httpBodyAsString = httpBody->flattenToString(); | 365 m_httpBodyAsString = httpBody->flattenToString(); |
| 366 } | 366 } |
| 367 | 367 |
| 368 setEncoding(m_encoding); | 368 setEncoding(m_encoding); |
| 369 } | 369 } |
| 370 | 370 |
| 371 void XSSAuditor::setEncoding(const WTF::TextEncoding& encoding) | 371 void XSSAuditor::setEncoding(const WTF::TextEncoding& encoding) |
| 372 { | 372 { |
| 373 const size_t miniumLengthForSuffixTree = 512; // FIXME: Tune this parameter. | 373 const size_t miniumLengthForSuffixTree = 512; // FIXME: Tune this parameter. |
| (...skipping 448 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 822 | 822 |
| 823 bool XSSAuditor::isSafeToSendToAnotherThread() const | 823 bool XSSAuditor::isSafeToSendToAnotherThread() const |
| 824 { | 824 { |
| 825 return m_documentURL.isSafeToSendToAnotherThread() | 825 return m_documentURL.isSafeToSendToAnotherThread() |
| 826 && m_decodedURL.isSafeToSendToAnotherThread() | 826 && m_decodedURL.isSafeToSendToAnotherThread() |
| 827 && m_decodedHTTPBody.isSafeToSendToAnotherThread() | 827 && m_decodedHTTPBody.isSafeToSendToAnotherThread() |
| 828 && m_httpBodyAsString.isSafeToSendToAnotherThread(); | 828 && m_httpBodyAsString.isSafeToSendToAnotherThread(); |
| 829 } | 829 } |
| 830 | 830 |
| 831 } // namespace blink | 831 } // namespace blink |
| OLD | NEW |