[HTML Import] Respect Content Security Policy Model

Source/core/page/ContentSecurityPolicy.h

 /*
  * Copyright (C) 2011 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 23 matching lines @@
 
 namespace WTF {
 class OrdinalNumber;
 }
 
 namespace WebCore {
 
 class CSPDirectiveList;
 class DOMStringList;
 class KURL;
+class ResourceResponse;
 class ScriptExecutionContext;
 class SecurityOrigin;
 
 typedef int SandboxFlags;
 typedef Vector<OwnPtr<CSPDirectiveList> > CSPDirectiveListVector;
 
+class ContentSecurityPolicyResponseHeaders {
+public:
+    ContentSecurityPolicyResponseHeaders() { }
+    explicit ContentSecurityPolicyResponseHeaders(const ResourceResponse&);
+
+    const String& contentSecurityPolicy() const { return m_contentSecuitryPolicy; }
+    const String& contentSecurityPolicyReportOnly() const { return m_contentSecurityPolicyReportOnly; }
+    const String& xWebKitCSP() const { return m_xWebKitCSP; }
+    const String& xWebKitCSPReportOnly() const { return m_xWebKitCSPReportOnly; }
+
+private:
+    String m_contentSecuitryPolicy;
+    String m_contentSecurityPolicyReportOnly;
+    String m_xWebKitCSP;
+    String m_xWebKitCSPReportOnly;
+};
+
 class ContentSecurityPolicy {
     WTF_MAKE_FAST_ALLOCATED;
 public:
     static PassOwnPtr<ContentSecurityPolicy> create(ScriptExecutionContext* scriptExecutionContext)
     {
         return adoptPtr(new ContentSecurityPolicy(scriptExecutionContext));
     }
     ~ContentSecurityPolicy();
 
     void copyStateFrom(const ContentSecurityPolicy*);
@@ skipping 12 matching lines @@
 
     // Be sure to update the behavior of XSSAuditor::combineXSSProtectionHeaderAndCSP whenever you change this enum's content or ordering.
     enum ReflectedXSSDisposition {
         ReflectedXSSUnset = 0,
         AllowReflectedXSS,
         ReflectedXSSInvalid,
         FilterReflectedXSS,
         BlockReflectedXSS
     };
 
+    void didReceiveHeaders(const ContentSecurityPolicyResponseHeaders&);
     void didReceiveHeader(const String&, HeaderType);
 
     // These functions are wrong because they assume that there is only one header.
     // FIXME: Replace them with functions that return vectors.
     const String& deprecatedHeader() const;
     HeaderType deprecatedHeaderType() const;
 
     bool allowJavaScriptURLs(const String& contextURL, const WTF::OrdinalNumber& contextLine, ReportingStatus = SendReport) const;
     bool allowInlineEventHandlers(const String& contextURL, const WTF::OrdinalNumber& contextLine, ReportingStatus = SendReport) const;
     bool allowInlineScript(const String& contextURL, const WTF::OrdinalNumber& contextLine, ReportingStatus = SendReport) const;
@@ skipping 42 matching lines @@
     String evalDisabledErrorMessage() const;
 
     bool experimentalFeaturesEnabled() const;
 
     static bool shouldBypassMainWorld(ScriptExecutionContext*);
 
 private:
     explicit ContentSecurityPolicy(ScriptExecutionContext*);
 
     void logToConsole(const String& message, const String& contextURL = String(), const WTF::OrdinalNumber& contextLine = WTF::OrdinalNumber::beforeFirst(), ScriptState* = 0) const;
+    void addPolicyFromHeaderValue(const String&, HeaderType);
 
     ScriptExecutionContext* m_scriptExecutionContext;
     bool m_overrideInlineStyleAllowed;
     CSPDirectiveListVector m_policies;
 };
 
 }
 
 #endif