[HTML Import] Respect Content Security Policy Model

Source/core/page/ContentSecurityPolicy.cpp

 /*
  * Copyright (C) 2011 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 23 matching lines @@
 #include "core/dom/Document.h"
 #include "core/dom/SecurityPolicyViolationEvent.h"
 #include "core/inspector/InspectorInstrumentation.h"
 #include "core/inspector/ScriptCallStack.h"
 #include "core/loader/DocumentLoader.h"
 #include "core/loader/PingLoader.h"
 #include "core/page/Frame.h"
 #include "core/page/UseCounter.h"
 #include "core/platform/JSONValues.h"
 #include "core/platform/network/FormData.h"
+#include "core/platform/network/ResourceResponse.h"
 #include "weborigin/KURL.h"
 #include "weborigin/KnownPorts.h"
 #include "weborigin/SchemeRegistry.h"
 #include "weborigin/SecurityOrigin.h"
 #include "wtf/HashSet.h"
 #include "wtf/text/TextPosition.h"
 #include "wtf/text/WTFString.h"
 
 namespace WebCore {
 
@@ skipping 102 matching lines @@
         return UseCounter::PrefixedContentSecurityPolicyReportOnly;
     case ContentSecurityPolicy::Report:
         return UseCounter::ContentSecurityPolicyReportOnly;
     }
     ASSERT_NOT_REACHED();
     return UseCounter::NumberOfFeatures;
 }
 
 } // namespace
 
+ContentSecurityPolicyResponseHeaders::ContentSecurityPolicyResponseHeaders(const ResourceResponse& response)
+    : m_contentSecuitryPolicy(response.httpHeaderField("Content-Security-Policy"))
+    , m_contentSecurityPolicyReportOnly(response.httpHeaderField("Content-Security-Policy-Report-Only"))
+    , m_xWebKitCSP(response.httpHeaderField("X-WebKit-CSP"))
+    , m_xWebKitCSPReportOnly(response.httpHeaderField("X-WebKit-CSP-Report-Only"))
+{
+}
+
 static bool skipExactly(const UChar*& position, const UChar* end, UChar delimiter)
 {
     if (position < end && *position == delimiter) {
         ++position;
         return true;
     }
     return false;
 }
 
 template<bool characterPredicate(UChar)>
@@ skipping 1233 matching lines @@
 }
 
 ContentSecurityPolicy::~ContentSecurityPolicy()
 {
 }
 
 void ContentSecurityPolicy::copyStateFrom(const ContentSecurityPolicy* other)
 {
     ASSERT(m_policies.isEmpty());
     for (CSPDirectiveListVector::const_iterator iter = other->m_policies.begin(); iter != other->m_policies.end(); ++iter)
-        didReceiveHeader((*iter)->header(), (*iter)->headerType());
+        addPolicyFromHeaderValue((*iter)->header(), (*iter)->headerType());
+}
+
+void ContentSecurityPolicy::didReceiveHeaders(const ContentSecurityPolicyResponseHeaders& headers)
+{
+    if (!headers.contentSecurityPolicy().isEmpty())
+        didReceiveHeader(headers.contentSecurityPolicy(), ContentSecurityPolicy::Enforce);
+    if (!headers.contentSecurityPolicyReportOnly().isEmpty())
+        didReceiveHeader(headers.contentSecurityPolicyReportOnly(), ContentSecurityPolicy::Report);
+    if (!headers.xWebKitCSP().isEmpty())
+        didReceiveHeader(headers.xWebKitCSP(), ContentSecurityPolicy::PrefixedEnforce);
+    if (!headers.xWebKitCSPReportOnly().isEmpty())
+        didReceiveHeader(headers.xWebKitCSPReportOnly(), ContentSecurityPolicy::PrefixedReport);
 }
 
 void ContentSecurityPolicy::didReceiveHeader(const String& header, HeaderType type)
 {
+    addPolicyFromHeaderValue(header, type);
+}
+
+void ContentSecurityPolicy::addPolicyFromHeaderValue(const String& header, HeaderType type)
+{
     if (m_scriptExecutionContext->isDocument()) {
         Document* document = toDocument(m_scriptExecutionContext);
         if (type == PrefixedReport || type == PrefixedEnforce)
             UseCounter::countDeprecation(document, getUseCounterType(type));
         else
             UseCounter::count(document, getUseCounterType(type));
     }
 
     Vector<UChar> characters;
     header.appendTo(characters);
@@ skipping 433 matching lines @@
 {
     if (context && context->isDocument()) {
         Document* document = toDocument(context);
         if (document->frame())
             return document->frame()->script()->shouldBypassMainWorldContentSecurityPolicy();
     }
     return false;
 }
 
 }