Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(280)

Issues Search
    My Issues | Starred     Open | Closed | All

Side by Side Diff: Source/core/dom/Document.cpp

Issue 132563006: CSP 1.1: <meta> delivery should be ignored outside <head>. (Closed) Base URL: https://chromium.googlesource.com/chromium/blink.git@master
Patch Set: Created 6 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« Source/core/dom/Document.h ('K') | « Source/core/dom/Document.h ('k') | Source/core/frame/ContentSecurityPolicy.h » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 /* 1 /*
2 * Copyright (C) 1999 Lars Knoll (knoll@kde.org) 2 * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
3 * (C) 1999 Antti Koivisto (koivisto@kde.org) 3 * (C) 1999 Antti Koivisto (koivisto@kde.org)
4 * (C) 2001 Dirk Mueller (mueller@kde.org) 4 * (C) 2001 Dirk Mueller (mueller@kde.org)
5 * (C) 2006 Alexey Proskuryakov (ap@webkit.org) 5 * (C) 2006 Alexey Proskuryakov (ap@webkit.org)
6 * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2012 Apple Inc. All r ights reserved. 6 * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2012 Apple Inc. All r ights reserved.
7 * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.t orchmobile.com/) 7 * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.t orchmobile.com/)
8 * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved. 8 * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved.
9 * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies) 9 * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
10 * Copyright (C) Research In Motion Limited 2010-2011. All rights reserved. 10 * Copyright (C) Research In Motion Limited 2010-2011. All rights reserved.
(...skipping 114 matching lines...) Expand 10 before | Expand all | Expand 10 after
125 #include "core/html/HTMLCanvasElement.h" 125 #include "core/html/HTMLCanvasElement.h"
126 #include "core/html/HTMLCollection.h" 126 #include "core/html/HTMLCollection.h"
127 #include "core/html/HTMLDialogElement.h" 127 #include "core/html/HTMLDialogElement.h"
128 #include "core/html/HTMLDocument.h" 128 #include "core/html/HTMLDocument.h"
129 #include "core/html/HTMLFrameOwnerElement.h" 129 #include "core/html/HTMLFrameOwnerElement.h"
130 #include "core/html/HTMLHeadElement.h" 130 #include "core/html/HTMLHeadElement.h"
131 #include "core/html/HTMLIFrameElement.h" 131 #include "core/html/HTMLIFrameElement.h"
132 #include "core/html/HTMLImport.h" 132 #include "core/html/HTMLImport.h"
133 #include "core/html/HTMLInputElement.h" 133 #include "core/html/HTMLInputElement.h"
134 #include "core/html/HTMLLinkElement.h" 134 #include "core/html/HTMLLinkElement.h"
135 #include "core/html/HTMLMetaElement.h"
135 #include "core/html/HTMLNameCollection.h" 136 #include "core/html/HTMLNameCollection.h"
136 #include "core/html/HTMLScriptElement.h" 137 #include "core/html/HTMLScriptElement.h"
137 #include "core/html/HTMLStyleElement.h" 138 #include "core/html/HTMLStyleElement.h"
138 #include "core/html/HTMLTitleElement.h" 139 #include "core/html/HTMLTitleElement.h"
139 #include "core/html/PluginDocument.h" 140 #include "core/html/PluginDocument.h"
140 #include "core/html/forms/FormController.h" 141 #include "core/html/forms/FormController.h"
141 #include "core/html/parser/HTMLDocumentParser.h" 142 #include "core/html/parser/HTMLDocumentParser.h"
142 #include "core/html/parser/HTMLParserIdioms.h" 143 #include "core/html/parser/HTMLParserIdioms.h"
143 #include "core/html/parser/NestingLevelIncrementer.h" 144 #include "core/html/parser/NestingLevelIncrementer.h"
144 #include "core/html/parser/TextResourceDecoder.h" 145 #include "core/html/parser/TextResourceDecoder.h"
(...skipping 2724 matching lines...) Expand 10 before | Expand all | Expand 10 after
2869 } 2870 }
2870 2871
2871 2872
2872 CSSStyleSheet* Document::elementSheet() 2873 CSSStyleSheet* Document::elementSheet()
2873 { 2874 {
2874 if (!m_elemSheet) 2875 if (!m_elemSheet)
2875 m_elemSheet = CSSStyleSheet::createInline(this, m_baseURL); 2876 m_elemSheet = CSSStyleSheet::createInline(this, m_baseURL);
2876 return m_elemSheet.get(); 2877 return m_elemSheet.get();
2877 } 2878 }
2878 2879
2879 void Document::processHttpEquiv(const AtomicString& equiv, const AtomicString& c ontent) 2880 void Document::processHttpEquiv(const AtomicString& equiv, const AtomicString& c ontent, bool inDocumentHead)
2880 { 2881 {
2881 ASSERT(!equiv.isNull() && !content.isNull()); 2882 ASSERT(!equiv.isNull() && !content.isNull());
2882 2883
2883 if (equalIgnoringCase(equiv, "default-style")) 2884 if (equalIgnoringCase(equiv, "default-style")) {
2884 processHttpEquivDefaultStyle(content); 2885 processHttpEquivDefaultStyle(content);
2885 else if (equalIgnoringCase(equiv, "refresh")) 2886 } else if (equalIgnoringCase(equiv, "refresh")) {
2886 processHttpEquivRefresh(content); 2887 processHttpEquivRefresh(content);
2887 else if (equalIgnoringCase(equiv, "set-cookie")) 2888 } else if (equalIgnoringCase(equiv, "set-cookie")) {
2888 processHttpEquivSetCookie(content); 2889 processHttpEquivSetCookie(content);
2889 else if (equalIgnoringCase(equiv, "content-language")) 2890 } else if (equalIgnoringCase(equiv, "content-language")) {
2890 setContentLanguage(content); 2891 setContentLanguage(content);
2891 else if (equalIgnoringCase(equiv, "x-dns-prefetch-control")) 2892 } else if (equalIgnoringCase(equiv, "x-dns-prefetch-control")) {
2892 parseDNSPrefetchControlHeader(content); 2893 parseDNSPrefetchControlHeader(content);
2893 else if (equalIgnoringCase(equiv, "x-frame-options")) 2894 } else if (equalIgnoringCase(equiv, "x-frame-options")) {
2894 processHttpEquivXFrameOptions(content); 2895 processHttpEquivXFrameOptions(content);
2895 else if (equalIgnoringCase(equiv, "content-security-policy") 2896 } else if (equalIgnoringCase(equiv, "content-security-policy")
2896 || equalIgnoringCase(equiv, "content-security-policy-report-only") 2897 || equalIgnoringCase(equiv, "content-security-policy-report-only")
2897 || equalIgnoringCase(equiv, "x-webkit-csp") 2898 || equalIgnoringCase(equiv, "x-webkit-csp")
2898 || equalIgnoringCase(equiv, "x-webkit-csp-report-only")) 2899 || equalIgnoringCase(equiv, "x-webkit-csp-report-only")) {
2899 processHttpEquivContentSecurityPolicy(equiv, content); 2900 if (inDocumentHead)
2901 processHttpEquivContentSecurityPolicy(equiv, content);
2902 else
2903 contentSecurityPolicy()->reportMetaOutsideHead(content);
2904 }
2900 } 2905 }
2901 2906
2902 void Document::processHttpEquivContentSecurityPolicy(const AtomicString& equiv, const AtomicString& content) 2907 void Document::processHttpEquivContentSecurityPolicy(const AtomicString& equiv, const AtomicString& content)
2903 { 2908 {
2904 if (equalIgnoringCase(equiv, "content-security-policy")) 2909 if (equalIgnoringCase(equiv, "content-security-policy"))
2905 contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicy ::Enforce, ContentSecurityPolicy::HeaderSourceMeta); 2910 contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicy ::Enforce, ContentSecurityPolicy::HeaderSourceMeta);
2906 else if (equalIgnoringCase(equiv, "content-security-policy-report-only")) 2911 else if (equalIgnoringCase(equiv, "content-security-policy-report-only"))
2907 contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicy ::Report, ContentSecurityPolicy::HeaderSourceMeta); 2912 contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicy ::Report, ContentSecurityPolicy::HeaderSourceMeta);
2908 // FIXME: Remove deprecation messages after the next release branch. 2913 // FIXME: Remove deprecation messages after the next release branch.
2909 else if (equalIgnoringCase(equiv, "x-webkit-csp")) 2914 else if (equalIgnoringCase(equiv, "x-webkit-csp"))
(...skipping 2509 matching lines...) Expand 10 before | Expand all | Expand 10 after
5419 void Document::defaultEventHandler(Event* event) 5424 void Document::defaultEventHandler(Event* event)
5420 { 5425 {
5421 if (frame() && frame()->remotePlatformLayer()) { 5426 if (frame() && frame()->remotePlatformLayer()) {
5422 frame()->chromeClient().forwardInputEvent(this, event); 5427 frame()->chromeClient().forwardInputEvent(this, event);
5423 return; 5428 return;
5424 } 5429 }
5425 Node::defaultEventHandler(event); 5430 Node::defaultEventHandler(event);
5426 } 5431 }
5427 5432
5428 } // namespace WebCore 5433 } // namespace WebCore
OLDNEW
« Source/core/dom/Document.h ('K') | « Source/core/dom/Document.h ('k') | Source/core/frame/ContentSecurityPolicy.h » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698