CSP3: Disable host-based whitelists in the presence of 'unsafe-dynamic'.

third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPDirectiveList.h"
 
 #include "core/dom/Document.h"
 #include "core/dom/SecurityContext.h"
 #include "core/dom/SpaceSplitString.h"
 #include "core/frame/LocalFrame.h"
@@ skipping 113 matching lines @@
     return !directive || directive->allowNonce(nonce);
 }
 
 bool CSPDirectiveList::checkHash(SourceListDirective* directive, const CSPHashValue& hashValue) const
 {
     return !directive || directive->allowHash(hashValue);
 }
 
 bool CSPDirectiveList::checkDynamic(SourceListDirective* directive) const
 {
+    if (!m_policy->experimentalFeaturesEnabled())
+        return false;
     return !directive || directive->allowDynamic();
 }
 
 bool CSPDirectiveList::checkSource(SourceListDirective* directive, const KURL& url, ContentSecurityPolicy::RedirectStatus redirectStatus) const
 {
     // If |url| is empty, fall back to the policy URL to ensure that <object>'s
     // without a `src` can be blocked/allowed, as they can still load plugins
     // even though they don't actually have a URL.
     return !directive || directive->allows(url.isEmpty() ? m_policy->url() : url, redirectStatus);
 }
@@ skipping 86 matching lines @@
     if (!m_reportOnly) {
         if (isScript)
             m_policy->reportBlockedScriptExecutionToInspector(directive->text());
         return false;
     }
     return true;
 }
 
 bool CSPDirectiveList::checkSourceAndReportViolation(SourceListDirective* directive, const KURL& url, const String& effectiveDirective, ContentSecurityPolicy::RedirectStatus redirectStatus) const
 {
-    if (checkSource(directive, url, redirectStatus))
+    if (!directive)
+        return true;
+
+    // We ignore URL-based whitelists if we're allowing dynamic script injection.
+    if (checkSource(directive, url, redirectStatus) && !checkDynamic(directive))
         return true;
 
     String prefix;
     if (ContentSecurityPolicy::BaseURI == effectiveDirective)
         prefix = "Refused to set the document's base URI to '";
     else if (ContentSecurityPolicy::ChildSrc == effectiveDirective)
         prefix = "Refused to create a child context containing '";
     else if (ContentSecurityPolicy::ConnectSrc == effectiveDirective)
         prefix = "Refused to connect to '";
     else if (ContentSecurityPolicy::FontSrc == effectiveDirective)
         prefix = "Refused to load the font '";
     else if (ContentSecurityPolicy::FormAction == effectiveDirective)
         prefix = "Refused to send form data to '";
     else if (ContentSecurityPolicy::FrameSrc == effectiveDirective)
         prefix = "Refused to frame '";
     else if (ContentSecurityPolicy::ImgSrc == effectiveDirective)
         prefix = "Refused to load the image '";
     else if (ContentSecurityPolicy::MediaSrc == effectiveDirective)
         prefix = "Refused to load media from '";
     else if (ContentSecurityPolicy::ManifestSrc == effectiveDirective)
         prefix = "Refused to load manifest from '";
     else if (ContentSecurityPolicy::ObjectSrc == effectiveDirective)
         prefix = "Refused to load plugin data from '";
     else if (ContentSecurityPolicy::ScriptSrc == effectiveDirective)
         prefix = "Refused to load the script '";
     else if (ContentSecurityPolicy::StyleSrc == effectiveDirective)
         prefix = "Refused to load the stylesheet '";
 
     String suffix = String();
+    if (checkDynamic(directive))
+        suffix = " 'unsafe-dynamic' is present, so host-based whitelisting is disabled.";
     if (directive == m_defaultSrc)
-        suffix = " Note that '" + effectiveDirective + "' was not explicitly set, so 'default-src' is used as a fallback.";
+        suffix = suffix + " Note that '" + effectiveDirective + "' was not explicitly set, so 'default-src' is used as a fallback.";
 
     reportViolation(directive->text(), effectiveDirective, prefix + url.elidedString() + "' because it violates the following Content Security Policy directive: \"" + directive->text() + "\"." + suffix + "\n", url);
     return denyIfEnforcingPolicy();
 }
 
 bool CSPDirectiveList::checkAncestorsAndReportViolation(SourceListDirective* directive, LocalFrame* frame, const KURL& url) const
 {
     if (checkAncestors(directive, frame))
         return true;
 
@@ skipping 531 matching lines @@
         setCSPDirective<SourceListDirective>(name, value, m_manifestSrc);
     } else if (RuntimeEnabledFeatures::suboriginsEnabled() && equalIgnoringCase(name, ContentSecurityPolicy::Suborigin)) {
         applySuboriginPolicy(name, value);
     } else {
         m_policy->reportUnsupportedDirective(name);
     }
 }
 
 
 } // namespace blink