Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(28)

Unified Diff: third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp

Issue 2190183002: Forward CSP violation reporting from RenderFrameProxy to RenderFrameImpl. Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Sanitize report endpoints from IPC against actual CSP contents. Created 4 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp
diff --git a/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp b/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp
index 2df252450035ef6b9a2f5743622acb5fed441688..5ca583b9d6541b03f1d9fa0deade27166062e22c 100644
--- a/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp
+++ b/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp
@@ -841,16 +841,6 @@ static void gatherSecurityPolicyViolationEventData(SecurityPolicyViolationEventI
void ContentSecurityPolicy::reportViolation(const String& directiveText, const String& effectiveDirective, const String& consoleMessage, const KURL& blockedURL, const Vector<String>& reportEndpoints, const String& header, ViolationType violationType, LocalFrame* contextFrame, RedirectStatus redirectStatus, int contextLine)
{
ASSERT(violationType == URLViolation || blockedURL.isEmpty());
-
- // TODO(lukasza): Support sending reports from OOPIFs - https://crbug.com/611232
- // (or move CSP child-src and frame-src checks to the browser process - see
- // https://crbug.com/376522).
- if (!m_executionContext && !contextFrame) {
- DCHECK(equalIgnoringCase(effectiveDirective, ContentSecurityPolicy::ChildSrc)
- || equalIgnoringCase(effectiveDirective, ContentSecurityPolicy::FrameSrc));
- return;
- }
-
ASSERT((m_executionContext && !contextFrame) || (equalIgnoringCase(effectiveDirective, ContentSecurityPolicy::FrameAncestors) && contextFrame));
// FIXME: Support sending reports from worker.
@@ -1125,4 +1115,15 @@ void ContentSecurityPolicy::didSendViolationReport(const String& report)
m_violationReportsSent.add(report.impl()->hash());
}
+bool ContentSecurityPolicy::coversReportEndpoint(const String& reportEndpointToVerify)
+{
+ for (const auto& policyList : m_policies) {
+ for (const String& actualReportEndpoint : policyList->reportEndpoints()) {
+ if (actualReportEndpoint == reportEndpointToVerify)
+ return true;
+ }
+ }
+ return false;
+}
+
} // namespace blink

Powered by Google App Engine
This is Rietveld 408576698