| OLD | NEW |
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "core/loader/HttpEquiv.h" | 5 #include "core/loader/HttpEquiv.h" |
| 6 | 6 |
| 7 #include "core/dom/Document.h" | 7 #include "core/dom/Document.h" |
| 8 #include "core/dom/StyleEngine.h" | 8 #include "core/dom/StyleEngine.h" |
| 9 #include "core/fetch/ClientHintsPreferences.h" | 9 #include "core/fetch/ClientHintsPreferences.h" |
| 10 #include "core/frame/UseCounter.h" | 10 #include "core/frame/UseCounter.h" |
| 11 #include "core/frame/csp/ContentSecurityPolicy.h" | 11 #include "core/frame/csp/ContentSecurityPolicy.h" |
| 12 #include "core/html/HTMLDocument.h" | 12 #include "core/html/HTMLDocument.h" |
| 13 #include "core/inspector/ConsoleMessage.h" | 13 #include "core/inspector/ConsoleMessage.h" |
| 14 #include "core/loader/DocumentLoader.h" | 14 #include "core/loader/DocumentLoader.h" |
| 15 #include "core/origin_trials/OriginTrials.h" |
| 15 #include "platform/network/HTTPParsers.h" | 16 #include "platform/network/HTTPParsers.h" |
| 16 #include "platform/weborigin/KURL.h" | 17 #include "platform/weborigin/KURL.h" |
| 17 | 18 |
| 18 namespace blink { | 19 namespace blink { |
| 19 | 20 |
| 20 void HttpEquiv::process(Document& document, const AtomicString& equiv, const Ato
micString& content, bool inDocumentHeadElement) | 21 void HttpEquiv::process(Document& document, const AtomicString& equiv, const Ato
micString& content, bool inDocumentHeadElement) |
| 21 { | 22 { |
| 22 ASSERT(!equiv.isNull() && !content.isNull()); | 23 ASSERT(!equiv.isNull() && !content.isNull()); |
| 23 | 24 |
| 24 if (equalIgnoringCase(equiv, "default-style")) { | 25 if (equalIgnoringCase(equiv, "default-style")) { |
| (...skipping 10 matching lines...) Expand all Loading... |
| 35 processHttpEquivXFrameOptions(document, content); | 36 processHttpEquivXFrameOptions(document, content); |
| 36 } else if (equalIgnoringCase(equiv, "accept-ch")) { | 37 } else if (equalIgnoringCase(equiv, "accept-ch")) { |
| 37 processHttpEquivAcceptCH(document, content); | 38 processHttpEquivAcceptCH(document, content); |
| 38 } else if (equalIgnoringCase(equiv, "content-security-policy") || equalIgnor
ingCase(equiv, "content-security-policy-report-only")) { | 39 } else if (equalIgnoringCase(equiv, "content-security-policy") || equalIgnor
ingCase(equiv, "content-security-policy-report-only")) { |
| 39 if (inDocumentHeadElement) | 40 if (inDocumentHeadElement) |
| 40 processHttpEquivContentSecurityPolicy(document, equiv, content); | 41 processHttpEquivContentSecurityPolicy(document, equiv, content); |
| 41 else | 42 else |
| 42 document.contentSecurityPolicy()->reportMetaOutsideHead(content); | 43 document.contentSecurityPolicy()->reportMetaOutsideHead(content); |
| 43 } else if (equalIgnoringCase(equiv, "suborigin")) { | 44 } else if (equalIgnoringCase(equiv, "suborigin")) { |
| 44 document.addConsoleMessage(ConsoleMessage::create(SecurityMessageSource,
ErrorMessageLevel, "Error with Suborigin header: Suborigin header with value '"
+ content + "' was delivered via a <meta> element and not an HTTP header, which
is disallowed. The Suborigin has been ignored.")); | 45 document.addConsoleMessage(ConsoleMessage::create(SecurityMessageSource,
ErrorMessageLevel, "Error with Suborigin header: Suborigin header with value '"
+ content + "' was delivered via a <meta> element and not an HTTP header, which
is disallowed. The Suborigin has been ignored.")); |
| 46 } else if (equalIgnoringCase(equiv, "origin-trial")) { |
| 47 OriginTrials::from(&document)->addToken(content.getString()); |
| 45 } | 48 } |
| 46 } | 49 } |
| 47 | 50 |
| 48 void HttpEquiv::processHttpEquivContentSecurityPolicy(Document& document, const
AtomicString& equiv, const AtomicString& content) | 51 void HttpEquiv::processHttpEquivContentSecurityPolicy(Document& document, const
AtomicString& equiv, const AtomicString& content) |
| 49 { | 52 { |
| 50 if (document.importLoader()) | 53 if (document.importLoader()) |
| 51 return; | 54 return; |
| 52 if (equalIgnoringCase(equiv, "content-security-policy")) | 55 if (equalIgnoringCase(equiv, "content-security-policy")) |
| 53 document.contentSecurityPolicy()->didReceiveHeader(content, ContentSecur
ityPolicyHeaderTypeEnforce, ContentSecurityPolicyHeaderSourceMeta); | 56 document.contentSecurityPolicy()->didReceiveHeader(content, ContentSecur
ityPolicyHeaderTypeEnforce, ContentSecurityPolicyHeaderSourceMeta); |
| 54 else if (equalIgnoringCase(equiv, "content-security-policy-report-only")) | 57 else if (equalIgnoringCase(equiv, "content-security-policy-report-only")) |
| (...skipping 49 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 104 frame->loader().stopAllLoaders(); | 107 frame->loader().stopAllLoaders(); |
| 105 // Stopping the loader isn't enough, as we're already parsing the document;
to honor the header's | 108 // Stopping the loader isn't enough, as we're already parsing the document;
to honor the header's |
| 106 // intent, we must navigate away from the possibly partially-rendered docume
nt to a location that | 109 // intent, we must navigate away from the possibly partially-rendered docume
nt to a location that |
| 107 // doesn't inherit the parent's SecurityOrigin. | 110 // doesn't inherit the parent's SecurityOrigin. |
| 108 // TODO(dglazkov): This should probably check document lifecycle instead. | 111 // TODO(dglazkov): This should probably check document lifecycle instead. |
| 109 if (document.frame()) | 112 if (document.frame()) |
| 110 frame->navigate(document, SecurityOrigin::urlWithUniqueSecurityOrigin(),
true, UserGestureStatus::None); | 113 frame->navigate(document, SecurityOrigin::urlWithUniqueSecurityOrigin(),
true, UserGestureStatus::None); |
| 111 } | 114 } |
| 112 | 115 |
| 113 } // namespace blink | 116 } // namespace blink |
| OLD | NEW |