OLD | NEW |
1 /* | 1 /* |
2 * Copyright (C) 2011 Google, Inc. All rights reserved. | 2 * Copyright (C) 2011 Google, Inc. All rights reserved. |
3 * | 3 * |
4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
5 * modification, are permitted provided that the following conditions | 5 * modification, are permitted provided that the following conditions |
6 * are met: | 6 * are met: |
7 * 1. Redistributions of source code must retain the above copyright | 7 * 1. Redistributions of source code must retain the above copyright |
8 * notice, this list of conditions and the following disclaimer. | 8 * notice, this list of conditions and the following disclaimer. |
9 * 2. Redistributions in binary form must reproduce the above copyright | 9 * 2. Redistributions in binary form must reproduce the above copyright |
10 * notice, this list of conditions and the following disclaimer in the | 10 * notice, this list of conditions and the following disclaimer in the |
(...skipping 11 matching lines...) Expand all Loading... |
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE | 22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
23 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | 23 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
24 */ | 24 */ |
25 | 25 |
26 #include "config.h" | 26 #include "config.h" |
27 #include "ContentSecurityPolicy.h" | 27 #include "ContentSecurityPolicy.h" |
28 | 28 |
29 #include "Console.h" | 29 #include "Console.h" |
30 #include "DOMStringList.h" | 30 #include "DOMStringList.h" |
31 #include "Document.h" | 31 #include "Document.h" |
| 32 #include "DeprecationAgent.h" |
32 #include "UseCounter.h" | 33 #include "UseCounter.h" |
33 #include "FormData.h" | 34 #include "FormData.h" |
34 #include "FormDataList.h" | 35 #include "FormDataList.h" |
35 #include "Frame.h" | 36 #include "Frame.h" |
36 #include "InspectorInstrumentation.h" | 37 #include "InspectorInstrumentation.h" |
37 #include "InspectorValues.h" | 38 #include "InspectorValues.h" |
38 #include "KURL.h" | 39 #include "KURL.h" |
39 #include "PingLoader.h" | 40 #include "PingLoader.h" |
40 #include "RuntimeEnabledFeatures.h" | 41 #include "RuntimeEnabledFeatures.h" |
41 #include "SchemeRegistry.h" | 42 #include "SchemeRegistry.h" |
(...skipping 1408 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1450 { | 1451 { |
1451 ASSERT(m_policies.isEmpty()); | 1452 ASSERT(m_policies.isEmpty()); |
1452 for (CSPDirectiveListVector::const_iterator iter = other->m_policies.begin()
; iter != other->m_policies.end(); ++iter) | 1453 for (CSPDirectiveListVector::const_iterator iter = other->m_policies.begin()
; iter != other->m_policies.end(); ++iter) |
1453 didReceiveHeader((*iter)->header(), (*iter)->headerType()); | 1454 didReceiveHeader((*iter)->header(), (*iter)->headerType()); |
1454 } | 1455 } |
1455 | 1456 |
1456 void ContentSecurityPolicy::didReceiveHeader(const String& header, HeaderType ty
pe) | 1457 void ContentSecurityPolicy::didReceiveHeader(const String& header, HeaderType ty
pe) |
1457 { | 1458 { |
1458 if (m_scriptExecutionContext->isDocument()) { | 1459 if (m_scriptExecutionContext->isDocument()) { |
1459 Document* document = toDocument(m_scriptExecutionContext); | 1460 Document* document = toDocument(m_scriptExecutionContext); |
1460 if (document->domWindow()) | 1461 UseCounter::observe(document, getUseCounterType(type)); |
1461 UseCounter::observe(document->domWindow(), getUseCounterType(type)); | 1462 |
| 1463 if (type == PrefixedReport || type == PrefixedEnforce) |
| 1464 DeprecationAgent::notify(document, DeprecationAgent::PrefixedContent
SecurityPolicyHeader); |
1462 } | 1465 } |
1463 | 1466 |
1464 if (type == PrefixedReport || type == PrefixedEnforce) | |
1465 reportDeprecatedHeader(type); | |
1466 | |
1467 // RFC2616, section 4.2 specifies that headers appearing multiple times can | 1467 // RFC2616, section 4.2 specifies that headers appearing multiple times can |
1468 // be combined with a comma. Walk the header string, and parse each comma | 1468 // be combined with a comma. Walk the header string, and parse each comma |
1469 // separated chunk as a separate header. | 1469 // separated chunk as a separate header. |
1470 const UChar* begin = header.characters(); | 1470 const UChar* begin = header.characters(); |
1471 const UChar* position = begin; | 1471 const UChar* position = begin; |
1472 const UChar* end = begin + header.length(); | 1472 const UChar* end = begin + header.length(); |
1473 while (position < end) { | 1473 while (position < end) { |
1474 skipUntil(position, end, ','); | 1474 skipUntil(position, end, ','); |
1475 | 1475 |
1476 // header1,header2 OR header1 | 1476 // header1,header2 OR header1 |
(...skipping 320 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1797 if (equalIgnoringCase(name, allow)) | 1797 if (equalIgnoringCase(name, allow)) |
1798 message = allowMessage; | 1798 message = allowMessage; |
1799 else if (equalIgnoringCase(name, options)) | 1799 else if (equalIgnoringCase(name, options)) |
1800 message = optionsMessage; | 1800 message = optionsMessage; |
1801 else if (equalIgnoringCase(name, policyURI)) | 1801 else if (equalIgnoringCase(name, policyURI)) |
1802 message = policyURIMessage; | 1802 message = policyURIMessage; |
1803 | 1803 |
1804 logToConsole(message); | 1804 logToConsole(message); |
1805 } | 1805 } |
1806 | 1806 |
1807 void ContentSecurityPolicy::reportDeprecatedHeader(HeaderType type) const | |
1808 { | |
1809 ASSERT(type == PrefixedEnforce || type == PrefixedReport); | |
1810 logToConsole(makeString("The '", type == PrefixedEnforce ? "X-WebKit-CSP" :
"X-WebKit-CSP-Report-Only", "' header is deprecated. Please consider using the u
nprefixed '", type == PrefixedEnforce ? "Content-Security-Policy" : "Content-Sec
urity-Policy-Report-Only", "' header instead.")); | |
1811 } | |
1812 | |
1813 void ContentSecurityPolicy::reportDirectiveAsSourceExpression(const String& dire
ctiveName, const String& sourceExpression) const | 1807 void ContentSecurityPolicy::reportDirectiveAsSourceExpression(const String& dire
ctiveName, const String& sourceExpression) const |
1814 { | 1808 { |
1815 String message = "The Content Security Policy directive '" + directiveName +
"' contains '" + sourceExpression + "' as a source expression. Did you mean '"
+ directiveName + " ...; " + sourceExpression + "...' (note the semicolon)?"; | 1809 String message = "The Content Security Policy directive '" + directiveName +
"' contains '" + sourceExpression + "' as a source expression. Did you mean '"
+ directiveName + " ...; " + sourceExpression + "...' (note the semicolon)?"; |
1816 logToConsole(message); | 1810 logToConsole(message); |
1817 } | 1811 } |
1818 | 1812 |
1819 void ContentSecurityPolicy::reportDuplicateDirective(const String& name) const | 1813 void ContentSecurityPolicy::reportDuplicateDirective(const String& name) const |
1820 { | 1814 { |
1821 String message = makeString("Ignoring duplicate Content-Security-Policy dire
ctive '", name, "'.\n"); | 1815 String message = makeString("Ignoring duplicate Content-Security-Policy dire
ctive '", name, "'.\n"); |
1822 logToConsole(message); | 1816 logToConsole(message); |
(...skipping 64 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1887 { | 1881 { |
1888 InspectorInstrumentation::scriptExecutionBlockedByCSP(m_scriptExecutionConte
xt, directiveText); | 1882 InspectorInstrumentation::scriptExecutionBlockedByCSP(m_scriptExecutionConte
xt, directiveText); |
1889 } | 1883 } |
1890 | 1884 |
1891 bool ContentSecurityPolicy::experimentalFeaturesEnabled() const | 1885 bool ContentSecurityPolicy::experimentalFeaturesEnabled() const |
1892 { | 1886 { |
1893 return RuntimeEnabledFeatures::experimentalContentSecurityPolicyFeaturesEnab
led(); | 1887 return RuntimeEnabledFeatures::experimentalContentSecurityPolicyFeaturesEnab
led(); |
1894 } | 1888 } |
1895 | 1889 |
1896 } | 1890 } |
OLD | NEW |