Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(559)

Side by Side Diff: Source/core/frame/csp/ContentSecurityPolicy.cpp

Issue 189373010: Get rid of WTF::SHA1. (Closed) Base URL: https://chromium.googlesource.com/chromium/blink.git@master
Patch Set: Rebase on ToT Created 6 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 /* 1 /*
2 * Copyright (C) 2011 Google, Inc. All rights reserved. 2 * Copyright (C) 2011 Google, Inc. All rights reserved.
3 * 3 *
4 * Redistribution and use in source and binary forms, with or without 4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions 5 * modification, are permitted provided that the following conditions
6 * are met: 6 * are met:
7 * 1. Redistributions of source code must retain the above copyright 7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer. 8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright 9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the 10 * notice, this list of conditions and the following disclaimer in the
(...skipping 26 matching lines...) Expand all
37 #include "core/frame/UseCounter.h" 37 #include "core/frame/UseCounter.h"
38 #include "core/frame/csp/CSPDirectiveList.h" 38 #include "core/frame/csp/CSPDirectiveList.h"
39 #include "core/frame/csp/CSPSource.h" 39 #include "core/frame/csp/CSPSource.h"
40 #include "core/frame/csp/CSPSourceList.h" 40 #include "core/frame/csp/CSPSourceList.h"
41 #include "core/frame/csp/MediaListDirective.h" 41 #include "core/frame/csp/MediaListDirective.h"
42 #include "core/frame/csp/SourceListDirective.h" 42 #include "core/frame/csp/SourceListDirective.h"
43 #include "core/inspector/InspectorInstrumentation.h" 43 #include "core/inspector/InspectorInstrumentation.h"
44 #include "core/inspector/ScriptCallStack.h" 44 #include "core/inspector/ScriptCallStack.h"
45 #include "core/loader/DocumentLoader.h" 45 #include "core/loader/DocumentLoader.h"
46 #include "core/loader/PingLoader.h" 46 #include "core/loader/PingLoader.h"
47 #include "platform/CryptoUtilities.h"
47 #include "platform/JSONValues.h" 48 #include "platform/JSONValues.h"
48 #include "platform/NotImplemented.h" 49 #include "platform/NotImplemented.h"
49 #include "platform/ParsingUtilities.h" 50 #include "platform/ParsingUtilities.h"
50 #include "platform/network/ContentSecurityPolicyParsers.h" 51 #include "platform/network/ContentSecurityPolicyParsers.h"
51 #include "platform/network/ContentSecurityPolicyResponseHeaders.h" 52 #include "platform/network/ContentSecurityPolicyResponseHeaders.h"
52 #include "platform/network/FormData.h" 53 #include "platform/network/FormData.h"
53 #include "platform/network/ResourceResponse.h" 54 #include "platform/network/ResourceResponse.h"
54 #include "platform/weborigin/KURL.h" 55 #include "platform/weborigin/KURL.h"
55 #include "platform/weborigin/KnownPorts.h" 56 #include "platform/weborigin/KnownPorts.h"
56 #include "platform/weborigin/SchemeRegistry.h" 57 #include "platform/weborigin/SchemeRegistry.h"
57 #include "platform/weborigin/SecurityOrigin.h" 58 #include "platform/weborigin/SecurityOrigin.h"
58 #include "public/platform/Platform.h" 59 #include "public/platform/Platform.h"
59 #include "public/platform/WebArrayBuffer.h" 60 #include "public/platform/WebArrayBuffer.h"
60 #include "public/platform/WebCrypto.h" 61 #include "public/platform/WebCrypto.h"
61 #include "public/platform/WebCryptoAlgorithm.h" 62 #include "public/platform/WebCryptoAlgorithm.h"
62 #include "wtf/HashMap.h"
63 #include "wtf/StringHasher.h" 63 #include "wtf/StringHasher.h"
64 #include "wtf/text/StringBuilder.h" 64 #include "wtf/text/StringBuilder.h"
65 #include "wtf/text/StringUTF8Adaptor.h" 65 #include "wtf/text/StringUTF8Adaptor.h"
66 66
67 namespace WebCore { 67 namespace WebCore {
68 68
69 // CSP 1.0 Directives 69 // CSP 1.0 Directives
70 const char ContentSecurityPolicy::ConnectSrc[] = "connect-src"; 70 const char ContentSecurityPolicy::ConnectSrc[] = "connect-src";
71 const char ContentSecurityPolicy::DefaultSrc[] = "default-src"; 71 const char ContentSecurityPolicy::DefaultSrc[] = "default-src";
72 const char ContentSecurityPolicy::FontSrc[] = "font-src"; 72 const char ContentSecurityPolicy::FontSrc[] = "font-src";
(...skipping 220 matching lines...) Expand 10 before | Expand all | Expand 10 after
293 template<bool (CSPDirectiveList::*allowed)(LocalFrame*, ContentSecurityPolicy::R eportingStatus) const> 293 template<bool (CSPDirectiveList::*allowed)(LocalFrame*, ContentSecurityPolicy::R eportingStatus) const>
294 bool isAllowedByAllWithFrame(const CSPDirectiveListVector& policies, LocalFrame* frame, ContentSecurityPolicy::ReportingStatus reportingStatus) 294 bool isAllowedByAllWithFrame(const CSPDirectiveListVector& policies, LocalFrame* frame, ContentSecurityPolicy::ReportingStatus reportingStatus)
295 { 295 {
296 for (size_t i = 0; i < policies.size(); ++i) { 296 for (size_t i = 0; i < policies.size(); ++i) {
297 if (!(policies[i].get()->*allowed)(frame, reportingStatus)) 297 if (!(policies[i].get()->*allowed)(frame, reportingStatus))
298 return false; 298 return false;
299 } 299 }
300 return true; 300 return true;
301 } 301 }
302 302
303 void computeDigest(const char* source, size_t length, blink::WebCryptoAlgorithmI d algorithmId, DigestValue& digest)
304 {
305 blink::WebCrypto* crypto = blink::Platform::current()->crypto();
306 blink::WebArrayBuffer result;
307
308 ASSERT(crypto);
309
310 crypto->digestSynchronous(algorithmId, reinterpret_cast<const unsigned char* >(source), length, result);
311
312 ASSERT(!result.isNull());
313
314 digest.append(reinterpret_cast<uint8_t*>(result.data()), result.byteLength() );
315 }
316
317 template<bool (CSPDirectiveList::*allowed)(const CSPHashValue&) const> 303 template<bool (CSPDirectiveList::*allowed)(const CSPHashValue&) const>
318 bool checkDigest(const String& source, uint8_t hashAlgorithmsUsed, const CSPDire ctiveListVector& policies) 304 bool checkDigest(const String& source, uint8_t hashAlgorithmsUsed, const CSPDire ctiveListVector& policies)
319 { 305 {
320 // Any additions or subtractions from this struct should also modify the 306 // Any additions or subtractions from this struct should also modify the
321 // respective entries in the kSupportedPrefixes array in 307 // respective entries in the kSupportedPrefixes array in
322 // CSPSourceList::parseHash(). 308 // CSPSourceList::parseHash().
323 static const struct { 309 static const struct {
324 ContentSecurityPolicyHashAlgorithm cspHashAlgorithm; 310 ContentSecurityPolicyHashAlgorithm cspHashAlgorithm;
325 blink::WebCryptoAlgorithmId webCryptoAlgorithmId; 311 CryptoUtil::HashAlgorithm algorithm;
326 } kAlgorithmMap[] = { 312 } kAlgorithmMap[] = {
327 { ContentSecurityPolicyHashAlgorithmSha1, blink::WebCryptoAlgorithmIdSha 1 }, 313 { ContentSecurityPolicyHashAlgorithmSha1, CryptoUtil::HashAlgorithmSha1 },
328 { ContentSecurityPolicyHashAlgorithmSha256, blink::WebCryptoAlgorithmIdS ha256 }, 314 { ContentSecurityPolicyHashAlgorithmSha256, CryptoUtil::HashAlgorithmSha 256 },
329 { ContentSecurityPolicyHashAlgorithmSha384, blink::WebCryptoAlgorithmIdS ha384 }, 315 { ContentSecurityPolicyHashAlgorithmSha384, CryptoUtil::HashAlgorithmSha 384 },
330 { ContentSecurityPolicyHashAlgorithmSha512, blink::WebCryptoAlgorithmIdS ha512 } 316 { ContentSecurityPolicyHashAlgorithmSha512, CryptoUtil::HashAlgorithmSha 512 }
331 }; 317 };
332 318
333 // Only bother normalizing the source/computing digests if there are any che cks to be done. 319 // Only bother normalizing the source/computing digests if there are any che cks to be done.
334 if (hashAlgorithmsUsed == ContentSecurityPolicyHashAlgorithmNone) 320 if (hashAlgorithmsUsed == ContentSecurityPolicyHashAlgorithmNone)
335 return false; 321 return false;
336 322
337 StringUTF8Adaptor normalizedSource(source, StringUTF8Adaptor::Normalize, WTF ::EntitiesForUnencodables); 323 StringUTF8Adaptor normalizedSource(source, StringUTF8Adaptor::Normalize, WTF ::EntitiesForUnencodables);
338 324
339 // See comment in CSPSourceList::parseHash about why we are using this sizeo f 325 // See comment in CSPSourceList::parseHash about why we are using this sizeo f
340 // calculation instead of WTF_ARRAY_LENGTH. 326 // calculation instead of WTF_ARRAY_LENGTH.
341 for (size_t i = 0; i < (sizeof(kAlgorithmMap) / sizeof(kAlgorithmMap[0])); i ++) { 327 for (size_t i = 0; i < (sizeof(kAlgorithmMap) / sizeof(kAlgorithmMap[0])); i ++) {
342 DigestValue digest; 328 CryptoUtil::DigestValue digest;
343 if (kAlgorithmMap[i].cspHashAlgorithm & hashAlgorithmsUsed) { 329 if (kAlgorithmMap[i].cspHashAlgorithm & hashAlgorithmsUsed) {
344 computeDigest(normalizedSource.data(), normalizedSource.length(), kA lgorithmMap[i].webCryptoAlgorithmId, digest); 330 CryptoUtil::computeDigest(kAlgorithmMap[i].algorithm, normalizedSour ce.data(), normalizedSource.length(), digest);
345 if (isAllowedByAllWithHash<allowed>(policies, CSPHashValue(kAlgorith mMap[i].cspHashAlgorithm, digest))) 331 if (isAllowedByAllWithHash<allowed>(policies, CSPHashValue(kAlgorith mMap[i].cspHashAlgorithm, digest)))
346 return true; 332 return true;
347 } 333 }
348 } 334 }
349 335
350 return false; 336 return false;
351 } 337 }
352 338
353 bool ContentSecurityPolicy::allowJavaScriptURLs(const String& contextURL, const WTF::OrdinalNumber& contextLine, ContentSecurityPolicy::ReportingStatus reportin gStatus) const 339 bool ContentSecurityPolicy::allowJavaScriptURLs(const String& contextURL, const WTF::OrdinalNumber& contextLine, ContentSecurityPolicy::ReportingStatus reportin gStatus) const
354 { 340 {
(...skipping 436 matching lines...) Expand 10 before | Expand all | Expand 10 after
791 // Collisions have no security impact, so we can save space by storing only the string's hash rather than the whole report. 777 // Collisions have no security impact, so we can save space by storing only the string's hash rather than the whole report.
792 return !m_violationReportsSent.contains(report.impl()->hash()); 778 return !m_violationReportsSent.contains(report.impl()->hash());
793 } 779 }
794 780
795 void ContentSecurityPolicy::didSendViolationReport(const String& report) 781 void ContentSecurityPolicy::didSendViolationReport(const String& report)
796 { 782 {
797 m_violationReportsSent.add(report.impl()->hash()); 783 m_violationReportsSent.add(report.impl()->hash());
798 } 784 }
799 785
800 } // namespace WebCore 786 } // namespace WebCore
OLDNEW

Powered by Google App Engine
This is Rietveld 408576698