Blink Plugins: Remove Shadow DOM Plugin Placeholder

Source/core/dom/StyleElement.cpp

 /*
  * Copyright (C) 2006, 2007 Rob Buis
  * Copyright (C) 2008 Apple, Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 138 matching lines @@
 void StyleElement::clearSheet(Element* ownerElement)
 {
     ASSERT(m_sheet);
 
     if (ownerElement && m_sheet->isLoading())
         ownerElement->document().styleEngine().removePendingSheet(ownerElement);
 
     m_sheet.release()->clearOwnerNode();
 }
 
-static bool shouldBypassMainWorldCSP(Element* element)
-{
-    // Main world CSP is bypassed within an isolated world.
-    LocalFrame* frame = element->document().frame();
-    if (frame && frame->script().shouldBypassMainWorldCSP())
-        return true;
-
-    // Main world CSP is bypassed for style elements in user agent shadow DOM.
-    ShadowRoot* root = element->containingShadowRoot();
-    if (root && root->type() == ShadowRootType::UserAgent)
-        return true;
-
-    return false;
-}
-
 StyleElement::ProcessingResult StyleElement::createSheet(Element* e, const String& text)
 {
     ASSERT(e);
     ASSERT(e->inDocument());
     Document& document = e->document();
 
+    // Inline style added from an isolated world should bypass the main world's
+    // CSP just as an inline script would.
+    LocalFrame* frame = document.frame();
+    bool shouldBypassMainWorldCSP = frame && frame->script().shouldBypassMainWorldCSP();

[tommycli, 2015/08/25 00:18:10]

Needs extra scrutiny. Your patch added the shadow dom STYLE CSP exemption. Do we
still need it?

[jbroman, 2015/08/25 00:34:10]

I'm not aware of any other users (but can't actually rule out any being added).
If nothing breaks, it's probably OK.

[jbroman, 2015/08/25 13:57:21]

FYI: I just got reminded of
https://code.google.com/p/chromium/issues/detail?id=424613 (which I filed, so I
ought to have remembered). It's possible that <marquee> may be relying, or may
start relying, on this, if it wants its CSS to work on CSP-restricted pages. (An
edge case, though, to be sure.)

This might be a reason to leave this logic intact.

[tommycli, 2015/08/25 16:48:17]

Done. I'll leave it intact.

+
     const ContentSecurityPolicy* csp = document.contentSecurityPolicy();
-    bool passesContentSecurityPolicyChecks = shouldBypassMainWorldCSP(e)
+    bool passesContentSecurityPolicyChecks = shouldBypassMainWorldCSP
         || csp->allowStyleWithHash(text)
         || csp->allowStyleWithNonce(e->fastGetAttribute(HTMLNames::nonceAttr))
         || csp->allowInlineStyle(e->document().url(), m_startPosition.m_line, text);
 
     // Clearing the current sheet may remove the cache entry so create the new sheet first
     RefPtrWillBeRawPtr<CSSStyleSheet> newSheet = nullptr;
 
     // If type is empty or CSS, this is a CSS style sheet.
     const AtomicString& type = this->type();
     if (isCSS(e, type) && passesContentSecurityPolicyChecks) {
@@ skipping 40 matching lines @@
 {
     document.styleEngine().addPendingSheet();
 }
 
 DEFINE_TRACE(StyleElement)
 {
     visitor->trace(m_sheet);
 }
 
 }