Fix csp flags send to browsers.

tools/testing/dart/http_server.dart

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 library http_server;
 
 import 'dart:async';
 import 'dart:io';
 import 'dart:isolate';
 import 'dart:uri';
@@ skipping 37 matching lines @@
   parser.addOption('crossOriginPort', abbr: 'c',
       help: 'A different port that accepts request from the main server port.',
       defaultsTo: '0');
   parser.addFlag('help', abbr: 'h', negatable: false,
       help: 'Print this usage information.');
   parser.addOption('build-directory', help: 'The build directory to use.');
   parser.addOption('network', help: 'The network interface to use.',
       defaultsTo: '127.0.0.1');
   parser.addFlag('csp', help: 'Use Content Security Policy restrictions.',
       defaultsTo: false);
+  parser.addOption('runtime', help: 'The runtime we are using (for csp flags).',
+      defaultsTo: 'none');
+
   var args = parser.parse(new Options().arguments);
   if (args['help']) {
     print(parser.getUsage());
   } else {
     // Pretend we're running test.dart so that TestUtils doesn't get confused
     // about the "current directory." This is only used if we're trying to run
     // this file independently for local testing.
     TestUtils.testScriptPath = new Path(new Options().script)
         .directoryPath
         .join(new Path('../../test.dart'))
         .canonicalize()
         .toNativePath();
     var servers = new TestingServers(new Path(args['build-directory']),
-                                     args['csp']);
+                                     args['csp'],
+                                     args['runtime']);
     var port = int.parse(args['port']);
     var crossOriginPort = int.parse(args['crossOriginPort']);
     servers.startServers(args['network'],
                          port: port,
                          crossOriginPort: crossOriginPort).then((_) {
       DebugLogger.info('Server listening on port ${servers.port}');
       DebugLogger.info('Server listening on port ${servers.crossOriginPort}');
     });
   }
 }
 
 /**
  * Runs a set of servers that are initialized specifically for the needs of our
  * test framework, such as dealing with package-root.
  */
 class TestingServers {
   List _serverList = [];
   Path _buildDirectory = null;
   final bool useContentSecurityPolicy;
+  final String runtime;
 
-  TestingServers(Path buildDirectory, this.useContentSecurityPolicy) {
+  TestingServers(Path buildDirectory,
+                 this.useContentSecurityPolicy,
+                 [String this.runtime = 'none']) {
     _buildDirectory = TestUtils.absolutePath(buildDirectory);
   }
 
   int get port => _serverList[0].port;
   int get crossOriginPort => _serverList[1].port;
 
   /**
    * [startServers] will start two Http servers.
    * The first server listens on [port] and sets
    *   "Access-Control-Allow-Origin: *"
    * The second server listens on [crossOriginPort] and sets
    *   "Access-Control-Allow-Origin: client:port1
    *   "Access-Control-Allow-Credentials: true"
    */
   Future startServers(String host, {int port: 0, int crossOriginPort: 0}) {
     return _startHttpServer(host, port: port).then((server) {
       return _startHttpServer(host,
                               port: crossOriginPort,
                               allowedPort:_serverList[0].port);
     });
   }
 
   String httpServerCommandline() {
     var dart = TestUtils.dartTestExecutable.toNativePath();
     var dartDir = TestUtils.dartDir();
     var script = dartDir.join(new Path("tools/testing/dart/http_server.dart"));
     var buildDirectory = _buildDirectory.toNativePath();
     var csp = useContentSecurityPolicy ? '--csp ' : '';
-
     return '$dart $script -p $port -c $crossOriginPort $csp'
-           '--build-directory=$buildDirectory';
+           '--build-directory=$buildDirectory --runtime=$runtime';
   }
 
   void stopServers() {
     for (var server in _serverList) {
       server.close();
     }
   }
 
   Future _startHttpServer(String host, {int port: 0, int allowedPort: -1}) {
     return HttpServer.bind(host, port).then((HttpServer httpServer) {
@@ skipping 179 matching lines @@
       response.headers.set('Access-Control-Allow-Credentials', 'true');
     } else {
       // No allowedPort specified. Allow from anywhere (but cross-origin
       // requests *with credentials* will fail because you can't use "*").
       response.headers.set("Access-Control-Allow-Origin", "*");
     }
     if (useContentSecurityPolicy) {
       // Chrome respects the standardized Content-Security-Policy header,
       // whereas Firefox and IE10 use X-Content-Security-Policy. Safari
       // still uses the WebKit- prefixed version.
+      var content_header_value = "script-src 'self'; object-src 'self'";
       for (var header in ["Content-Security-Policy",
-                          "X-Content-Security-Policy",
-                          "X-WebKit-CSP"]) {
-        response.headers.set(header, "script-src 'self'; object-src 'self'");
+                          "X-Content-Security-Policy"]) {
+        response.headers.set(header, content_header_value);
+      }
+      if (const ["safari"].contains(runtime)) {
+        response.headers.set("X-WebKit-CSP", content_header_value);
       }
     }
     if (path.filename.endsWith('.html')) {
       response.headers.set('Content-Type', 'text/html');
     } else if (path.filename.endsWith('.js')) {
       response.headers.set('Content-Type', 'application/javascript');
     } else if (path.filename.endsWith('.dart')) {
       response.headers.set('Content-Type', 'application/dart');
     }
     file.openRead().pipe(response).catchError((e) {
@@ skipping 23 matching lines @@
 class _Entry {
   final String name;
   final String displayName;
 
   _Entry(this.name, this.displayName);
 
   int compareTo(_Entry other) {
     return name.compareTo(other.name);
   }
 }