ContentSecurityPolicy: avoid defining static String singletons.

third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp

 /*
  * Copyright (C) 2011 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 127 matching lines @@
 
   bool nonceable = true;
 
   // To prevent an attacker from hijacking an existing nonce via a dangling
   // markup injection, we walk through the attributes of each nonced script
   // element: if their names or values contain "<script" or "<style", we won't
   // apply the nonce when loading script.
   //
   // See http://blog.innerht.ml/csp-2015/#danglingmarkupinjection for an example
   // of the kind of attack this is aimed at mitigating.
-  DEFINE_STATIC_LOCAL(AtomicString, scriptString, ("<script"));
-  DEFINE_STATIC_LOCAL(AtomicString, styleString, ("<style"));
+  static const char scriptString[] = "<script";
+  static const char styleString[] = "<style";
   for (const Attribute& attr : element->attributes()) {
     AtomicString name = attr.localName().lowerASCII();
     AtomicString value = attr.value().lowerASCII();
     if (name.find(scriptString) != WTF::kNotFound ||
         name.find(styleString) != WTF::kNotFound ||
         value.find(scriptString) != WTF::kNotFound ||
         value.find(styleString) != WTF::kNotFound) {
       nonceable = false;
       break;
     }
@@ skipping 1139 matching lines @@
 
 void ContentSecurityPolicy::reportInvalidDirectiveInMeta(
     const String& directive) {
   logToConsole(
       "Content Security Policies delivered via a <meta> element may not "
       "contain the " +
       directive + " directive.");
 }
 
 void ContentSecurityPolicy::reportUnsupportedDirective(const String& name) {
-  DEFINE_STATIC_LOCAL(String, allow, ("allow"));
-  DEFINE_STATIC_LOCAL(String, options, ("options"));
-  DEFINE_STATIC_LOCAL(String, policyURI, ("policy-uri"));
-  DEFINE_STATIC_LOCAL(
-      String, allowMessage,
-      ("The 'allow' directive has been replaced with 'default-src'. Please use "
-       "that directive instead, as 'allow' has no effect."));
-  DEFINE_STATIC_LOCAL(
-      String, optionsMessage,
-      ("The 'options' directive has been replaced with 'unsafe-inline' and "
-       "'unsafe-eval' source expressions for the 'script-src' and 'style-src' "
-       "directives. Please use those directives instead, as 'options' has no "
-       "effect."));
-  DEFINE_STATIC_LOCAL(String, policyURIMessage,
-                      ("The 'policy-uri' directive has been removed from the "
-                       "specification. Please specify a complete policy via "
-                       "the Content-Security-Policy header."));
+  static const char allow[] = "allow";
+  static const char options[] = "options";
+  static const char policyURI[] = "policy-uri";
+  static const char allowMessage[] =
+      "The 'allow' directive has been replaced with 'default-src'. Please use "
+      "that directive instead, as 'allow' has no effect.";
+  static const char optionsMessage[] =
+      "The 'options' directive has been replaced with 'unsafe-inline' and "
+      "'unsafe-eval' source expressions for the 'script-src' and 'style-src' "
+      "directives. Please use those directives instead, as 'options' has no "
+      "effect.";
+  static const char policyURIMessage[] =
+      "The 'policy-uri' directive has been removed from the "
+      "specification. Please specify a complete policy via "
+      "the Content-Security-Policy header.";
 
   String message =
       "Unrecognized Content-Security-Policy directive '" + name + "'.\n";
   MessageLevel level = ErrorMessageLevel;
   if (equalIgnoringCase(name, allow)) {
     message = allowMessage;
   } else if (equalIgnoringCase(name, options)) {
     message = optionsMessage;
   } else if (equalIgnoringCase(name, policyURI)) {
     message = policyURIMessage;
@@ skipping 178 matching lines @@
   // Collisions have no security impact, so we can save space by storing only
   // the string's hash rather than the whole report.
   return !m_violationReportsSent.contains(report.impl()->hash());
 }
 
 void ContentSecurityPolicy::didSendViolationReport(const String& report) {
   m_violationReportsSent.add(report.impl()->hash());
 }
 
 }  // namespace blink