OLD | NEW |
---|---|
1 /* | 1 /* |
2 * Copyright (C) 2011 Google, Inc. All rights reserved. | 2 * Copyright (C) 2011 Google, Inc. All rights reserved. |
3 * | 3 * |
4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
5 * modification, are permitted provided that the following conditions | 5 * modification, are permitted provided that the following conditions |
6 * are met: | 6 * are met: |
7 * 1. Redistributions of source code must retain the above copyright | 7 * 1. Redistributions of source code must retain the above copyright |
8 * notice, this list of conditions and the following disclaimer. | 8 * notice, this list of conditions and the following disclaimer. |
9 * 2. Redistributions in binary form must reproduce the above copyright | 9 * 2. Redistributions in binary form must reproduce the above copyright |
10 * notice, this list of conditions and the following disclaimer in the | 10 * notice, this list of conditions and the following disclaimer in the |
(...skipping 293 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
304 ContentSecurityPolicyHeaderType type, | 304 ContentSecurityPolicyHeaderType type, |
305 ContentSecurityPolicyHeaderSource source) { | 305 ContentSecurityPolicyHeaderSource source) { |
306 addAndReportPolicyFromHeaderValue(header, type, source); | 306 addAndReportPolicyFromHeaderValue(header, type, source); |
307 | 307 |
308 // This might be called after we've been bound to an execution context. For | 308 // This might be called after we've been bound to an execution context. For |
309 // example, a <meta> element might be injected after page load. | 309 // example, a <meta> element might be injected after page load. |
310 if (m_executionContext) | 310 if (m_executionContext) |
311 applyPolicySideEffectsToExecutionContext(); | 311 applyPolicySideEffectsToExecutionContext(); |
312 } | 312 } |
313 | 313 |
314 bool ContentSecurityPolicy::checkAllowBlanketEnforcement( | |
315 const ResourceResponse& response, | |
316 const KURL& parentUrl) { | |
317 if (response.url().isEmpty() || response.url().protocolIsAbout() || | |
318 response.url().protocolIsAbout() || response.url().protocolIs("blob") || | |
Mike West
2016/10/13 11:01:42
Nit: One of these `protocolIsAbout` should probabl
| |
319 response.url().protocolIs("filesystem")) { | |
320 return true; | |
321 } | |
322 | |
323 if (parentUrl.protocol() == response.url().protocol() && | |
324 parentUrl.host() == response.url().host() && | |
325 parentUrl.port() == response.url().port()) { | |
326 return true; | |
327 } | |
Mike West
2016/10/13 11:01:42
If you pass in an origin, you can change this to `
| |
328 | |
329 HTTPHeaderMap::const_iterator it = | |
330 response.httpHeaderFields().find(HTTPNames::Allow_CSP_From); | |
331 | |
332 String header = | |
333 it != response.httpHeaderFields().end() ? it->value : nullAtom; | |
Mike West
2016/10/13 11:01:42
You can simplify this check down to something like
| |
334 | |
335 if (header.isEmpty() || !header.containsOnlyASCII()) | |
336 return false; | |
337 | |
338 Vector<String> headers; | |
339 header.split(',', headers); | |
Mike West
2016/10/13 11:01:42
I think we probably don't want to look at all the
| |
340 for (size_t i = 0; i < headers.size(); i++) { | |
341 String currentHeader = headers[i].stripWhiteSpace(); | |
342 if (equalIgnoringCase(currentHeader, "*")) { | |
Mike West
2016/10/13 11:01:42
No need for case-folding here: `*` is not a cased
| |
343 return true; | |
344 } | |
345 const KURL allowed(ParsedURLString, currentHeader); | |
346 if (allowed.isValid() && parentUrl.protocol() == allowed.protocol() && | |
347 parentUrl.host() == allowed.host() && | |
348 parentUrl.port() == allowed.port()) { | |
349 return true; | |
350 } | |
Mike West
2016/10/13 11:01:42
This should also be an origin check. That is, `par
| |
351 } | |
352 | |
353 return false; | |
354 } | |
355 | |
314 void ContentSecurityPolicy::addPolicyFromHeaderValue( | 356 void ContentSecurityPolicy::addPolicyFromHeaderValue( |
315 const String& header, | 357 const String& header, |
316 ContentSecurityPolicyHeaderType type, | 358 ContentSecurityPolicyHeaderType type, |
317 ContentSecurityPolicyHeaderSource source) { | 359 ContentSecurityPolicyHeaderSource source) { |
318 // If this is a report-only header inside a <meta> element, bail out. | 360 // If this is a report-only header inside a <meta> element, bail out. |
319 if (source == ContentSecurityPolicyHeaderSourceMeta && | 361 if (source == ContentSecurityPolicyHeaderSourceMeta && |
320 type == ContentSecurityPolicyHeaderTypeReport) { | 362 type == ContentSecurityPolicyHeaderTypeReport) { |
321 reportReportOnlyInMeta(header); | 363 reportReportOnlyInMeta(header); |
322 return; | 364 return; |
323 } | 365 } |
(...skipping 1155 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
1479 // Collisions have no security impact, so we can save space by storing only | 1521 // Collisions have no security impact, so we can save space by storing only |
1480 // the string's hash rather than the whole report. | 1522 // the string's hash rather than the whole report. |
1481 return !m_violationReportsSent.contains(report.impl()->hash()); | 1523 return !m_violationReportsSent.contains(report.impl()->hash()); |
1482 } | 1524 } |
1483 | 1525 |
1484 void ContentSecurityPolicy::didSendViolationReport(const String& report) { | 1526 void ContentSecurityPolicy::didSendViolationReport(const String& report) { |
1485 m_violationReportsSent.add(report.impl()->hash()); | 1527 m_violationReportsSent.add(report.impl()->hash()); |
1486 } | 1528 } |
1487 | 1529 |
1488 } // namespace blink | 1530 } // namespace blink |
OLD | NEW |