Remove the 'reflected-xss' directive from CSP.

third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPDirectiveList.h"
 
 #include "bindings/core/v8/SourceLocation.h"
 #include "core/dom/Document.h"
 #include "core/dom/SecurityContext.h"
 #include "core/dom/SpaceSplitString.h"
@@ skipping 34 matching lines @@
 
 }  // namespace
 
 CSPDirectiveList::CSPDirectiveList(ContentSecurityPolicy* policy,
                                    ContentSecurityPolicyHeaderType type,
                                    ContentSecurityPolicyHeaderSource source)
     : m_policy(policy),
       m_headerType(type),
       m_headerSource(source),
       m_hasSandboxPolicy(false),
-      m_reflectedXSSDisposition(ReflectedXSSUnset),
       m_didSetReferrerPolicy(false),
       m_referrerPolicy(ReferrerPolicyDefault),
       m_strictMixedContentCheckingEnforced(false),
       m_upgradeInsecureRequests(false),
       m_treatAsPublicAddress(false),
       m_requireSRIFor(RequireSRIForToken::None) {}
 
 CSPDirectiveList* CSPDirectiveList::create(
     ContentSecurityPolicy* policy,
     const UChar* begin,
@@ skipping 998 matching lines @@
     m_policy->reportDuplicateDirective(name);
     return;
   }
   m_upgradeInsecureRequests = true;
 
   m_policy->upgradeInsecureRequests();
   if (!value.isEmpty())
     m_policy->reportValueForEmptyDirective(name, value);
 }
 
-void CSPDirectiveList::parseReflectedXSS(const String& name,
-                                         const String& value) {
-  if (m_reflectedXSSDisposition != ReflectedXSSUnset) {
-    m_policy->reportDuplicateDirective(name);
-    m_reflectedXSSDisposition = ReflectedXSSInvalid;
-    return;
-  }
-
-  if (value.isEmpty()) {
-    m_reflectedXSSDisposition = ReflectedXSSInvalid;
-    m_policy->reportInvalidReflectedXSS(value);
-    return;
-  }
-
-  Vector<UChar> characters;
-  value.appendTo(characters);
-
-  const UChar* position = characters.data();
-  const UChar* end = position + characters.size();
-
-  skipWhile<UChar, isASCIISpace>(position, end);
-  const UChar* begin = position;
-  skipWhile<UChar, isNotASCIISpace>(position, end);
-
-  StringView token(begin, position - begin);
-
-  // value1
-  //       ^
-  if (equalIgnoringCase("allow", token)) {
-    m_reflectedXSSDisposition = AllowReflectedXSS;
-  } else if (equalIgnoringCase("filter", token)) {
-    m_reflectedXSSDisposition = FilterReflectedXSS;
-  } else if (equalIgnoringCase("block", token)) {
-    m_reflectedXSSDisposition = BlockReflectedXSS;
-  } else {
-    m_reflectedXSSDisposition = ReflectedXSSInvalid;
-    m_policy->reportInvalidReflectedXSS(value);
-    return;
-  }
-
-  skipWhile<UChar, isASCIISpace>(position, end);
-  if (position == end && m_reflectedXSSDisposition != ReflectedXSSUnset)
-    return;
-
-  // value1 value2
-  //        ^
-  m_reflectedXSSDisposition = ReflectedXSSInvalid;
-  m_policy->reportInvalidReflectedXSS(value);
-}
-
 void CSPDirectiveList::parseReferrer(const String& name, const String& value) {
   m_didSetReferrerPolicy = true;
 
   if (value.isEmpty()) {
     m_policy->reportInvalidReferrer(value);
     m_referrerPolicy = ReferrerPolicyNever;
     return;
   }
 
   Vector<UChar> characters;
@@ skipping 70 matching lines @@
   } else if (equalIgnoringCase(name, ContentSecurityPolicy::ReportURI)) {
     parseReportURI(name, value);
   } else if (equalIgnoringCase(name, ContentSecurityPolicy::BaseURI)) {
     setCSPDirective<SourceListDirective>(name, value, m_baseURI);
   } else if (equalIgnoringCase(name, ContentSecurityPolicy::ChildSrc)) {
     setCSPDirective<SourceListDirective>(name, value, m_childSrc);
   } else if (equalIgnoringCase(name, ContentSecurityPolicy::FormAction)) {
     setCSPDirective<SourceListDirective>(name, value, m_formAction);
   } else if (equalIgnoringCase(name, ContentSecurityPolicy::PluginTypes)) {
     setCSPDirective<MediaListDirective>(name, value, m_pluginTypes);
-  } else if (equalIgnoringCase(name, ContentSecurityPolicy::ReflectedXSS)) {
-    parseReflectedXSS(name, value);
   } else if (equalIgnoringCase(name, ContentSecurityPolicy::Referrer)) {
     parseReferrer(name, value);
   } else if (equalIgnoringCase(
                  name, ContentSecurityPolicy::UpgradeInsecureRequests)) {
     enableInsecureRequestsUpgrade(name, value);
   } else if (equalIgnoringCase(name,
                                ContentSecurityPolicy::BlockAllMixedContent)) {
     enforceStrictMixedContentChecking(name, value);
   } else if (equalIgnoringCase(name, ContentSecurityPolicy::ManifestSrc)) {
     setCSPDirective<SourceListDirective>(name, value, m_manifestSrc);
@@ skipping 21 matching lines @@
   visitor->trace(m_frameSrc);
   visitor->trace(m_imgSrc);
   visitor->trace(m_mediaSrc);
   visitor->trace(m_manifestSrc);
   visitor->trace(m_objectSrc);
   visitor->trace(m_scriptSrc);
   visitor->trace(m_styleSrc);
 }
 
 }  // namespace blink