| OLD | NEW |
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "core/loader/HttpEquiv.h" | 5 #include "core/loader/HttpEquiv.h" |
| 6 | 6 |
| 7 #include "core/dom/Document.h" | 7 #include "core/dom/Document.h" |
| 8 #include "core/dom/ScriptableDocumentParser.h" | |
| 9 #include "core/dom/StyleEngine.h" | 8 #include "core/dom/StyleEngine.h" |
| 10 #include "core/fetch/ClientHintsPreferences.h" | 9 #include "core/fetch/ClientHintsPreferences.h" |
| 11 #include "core/frame/UseCounter.h" | 10 #include "core/frame/UseCounter.h" |
| 12 #include "core/frame/csp/ContentSecurityPolicy.h" | 11 #include "core/frame/csp/ContentSecurityPolicy.h" |
| 13 #include "core/html/HTMLDocument.h" | 12 #include "core/html/HTMLDocument.h" |
| 14 #include "core/inspector/ConsoleMessage.h" | 13 #include "core/inspector/ConsoleMessage.h" |
| 15 #include "core/loader/DocumentLoader.h" | 14 #include "core/loader/DocumentLoader.h" |
| 16 #include "core/origin_trials/OriginTrialContext.h" | |
| 17 #include "platform/HTTPNames.h" | |
| 18 #include "platform/network/HTTPParsers.h" | 15 #include "platform/network/HTTPParsers.h" |
| 19 #include "platform/weborigin/KURL.h" | 16 #include "platform/weborigin/KURL.h" |
| 20 | 17 |
| 21 namespace blink { | 18 namespace blink { |
| 22 | 19 |
| 23 void HttpEquiv::process(Document& document, const AtomicString& equiv, const Ato
micString& content, bool inDocumentHeadElement) | 20 void HttpEquiv::process(Document& document, const AtomicString& equiv, const Ato
micString& content, bool inDocumentHeadElement) |
| 24 { | 21 { |
| 25 ASSERT(!equiv.isNull() && !content.isNull()); | 22 ASSERT(!equiv.isNull() && !content.isNull()); |
| 26 | 23 |
| 27 if (equalIgnoringCase(equiv, "default-style")) { | 24 if (equalIgnoringCase(equiv, "default-style")) { |
| (...skipping 10 matching lines...) Expand all Loading... |
| 38 processHttpEquivXFrameOptions(document, content); | 35 processHttpEquivXFrameOptions(document, content); |
| 39 } else if (equalIgnoringCase(equiv, "accept-ch")) { | 36 } else if (equalIgnoringCase(equiv, "accept-ch")) { |
| 40 processHttpEquivAcceptCH(document, content); | 37 processHttpEquivAcceptCH(document, content); |
| 41 } else if (equalIgnoringCase(equiv, "content-security-policy") || equalIgnor
ingCase(equiv, "content-security-policy-report-only")) { | 38 } else if (equalIgnoringCase(equiv, "content-security-policy") || equalIgnor
ingCase(equiv, "content-security-policy-report-only")) { |
| 42 if (inDocumentHeadElement) | 39 if (inDocumentHeadElement) |
| 43 processHttpEquivContentSecurityPolicy(document, equiv, content); | 40 processHttpEquivContentSecurityPolicy(document, equiv, content); |
| 44 else | 41 else |
| 45 document.contentSecurityPolicy()->reportMetaOutsideHead(content); | 42 document.contentSecurityPolicy()->reportMetaOutsideHead(content); |
| 46 } else if (equalIgnoringCase(equiv, "suborigin")) { | 43 } else if (equalIgnoringCase(equiv, "suborigin")) { |
| 47 document.addConsoleMessage(ConsoleMessage::create(SecurityMessageSource,
ErrorMessageLevel, "Error with Suborigin header: Suborigin header with value '"
+ content + "' was delivered via a <meta> element and not an HTTP header, which
is disallowed. The Suborigin has been ignored.")); | 44 document.addConsoleMessage(ConsoleMessage::create(SecurityMessageSource,
ErrorMessageLevel, "Error with Suborigin header: Suborigin header with value '"
+ content + "' was delivered via a <meta> element and not an HTTP header, which
is disallowed. The Suborigin has been ignored.")); |
| 48 } else if (equalIgnoringCase(equiv, HTTPNames::Origin_Trial)) { | |
| 49 if (inDocumentHeadElement) | |
| 50 OriginTrialContext::from(&document)->addToken(content); | |
| 51 } | 45 } |
| 52 } | 46 } |
| 53 | 47 |
| 54 void HttpEquiv::processHttpEquivContentSecurityPolicy(Document& document, const
AtomicString& equiv, const AtomicString& content) | 48 void HttpEquiv::processHttpEquivContentSecurityPolicy(Document& document, const
AtomicString& equiv, const AtomicString& content) |
| 55 { | 49 { |
| 56 if (document.importLoader()) | 50 if (document.importLoader()) |
| 57 return; | 51 return; |
| 58 if (equalIgnoringCase(equiv, "content-security-policy")) | 52 if (equalIgnoringCase(equiv, "content-security-policy")) |
| 59 document.contentSecurityPolicy()->didReceiveHeader(content, ContentSecur
ityPolicyHeaderTypeEnforce, ContentSecurityPolicyHeaderSourceMeta); | 53 document.contentSecurityPolicy()->didReceiveHeader(content, ContentSecur
ityPolicyHeaderTypeEnforce, ContentSecurityPolicyHeaderSourceMeta); |
| 60 else if (equalIgnoringCase(equiv, "content-security-policy-report-only")) | 54 else if (equalIgnoringCase(equiv, "content-security-policy-report-only")) |
| (...skipping 49 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 110 frame->loader().stopAllLoaders(); | 104 frame->loader().stopAllLoaders(); |
| 111 // Stopping the loader isn't enough, as we're already parsing the document;
to honor the header's | 105 // Stopping the loader isn't enough, as we're already parsing the document;
to honor the header's |
| 112 // intent, we must navigate away from the possibly partially-rendered docume
nt to a location that | 106 // intent, we must navigate away from the possibly partially-rendered docume
nt to a location that |
| 113 // doesn't inherit the parent's SecurityOrigin. | 107 // doesn't inherit the parent's SecurityOrigin. |
| 114 // TODO(dglazkov): This should probably check document lifecycle instead. | 108 // TODO(dglazkov): This should probably check document lifecycle instead. |
| 115 if (document.frame()) | 109 if (document.frame()) |
| 116 frame->navigate(document, SecurityOrigin::urlWithUniqueSecurityOrigin(),
true, UserGestureStatus::None); | 110 frame->navigate(document, SecurityOrigin::urlWithUniqueSecurityOrigin(),
true, UserGestureStatus::None); |
| 117 } | 111 } |
| 118 | 112 |
| 119 } // namespace blink | 113 } // namespace blink |
| OLD | NEW |