Unreverting Embedding-CSP: Refactoring directive strings into enum.

third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPDirectiveList.h"
 
 #include "bindings/core/v8/SourceLocation.h"
 #include "core/dom/Document.h"
 #include "core/dom/SecurityContext.h"
 #include "core/dom/SpaceSplitString.h"
@@ skipping 69 matching lines @@
   if (directives->isReportOnly() &&
       source != ContentSecurityPolicyHeaderSourceMeta &&
       directives->reportEndpoints().isEmpty())
     policy->reportMissingReportURI(String(begin, end - begin));
 
   return directives;
 }
 
 void CSPDirectiveList::reportViolation(
     const String& directiveText,
-    const String& effectiveDirective,
+    const ContentSecurityPolicy::DirectiveType& effectiveType,
     const String& consoleMessage,
     const KURL& blockedURL,
     ResourceRequest::RedirectStatus redirectStatus) const {
   String message =
       isReportOnly() ? "[Report Only] " + consoleMessage : consoleMessage;
   m_policy->logToConsole(ConsoleMessage::create(SecurityMessageSource,
                                                 ErrorMessageLevel, message));
-  m_policy->reportViolation(directiveText, effectiveDirective, message,
-                            blockedURL, m_reportEndpoints, m_header,
-                            m_headerType, ContentSecurityPolicy::URLViolation,
-                            nullptr, redirectStatus);
+  m_policy->reportViolation(directiveText, effectiveType, message, blockedURL,
+                            m_reportEndpoints, m_header, m_headerType,
+                            ContentSecurityPolicy::URLViolation, nullptr,
+                            redirectStatus);
 }
 
 void CSPDirectiveList::reportViolationWithFrame(
     const String& directiveText,
-    const String& effectiveDirective,
+    const ContentSecurityPolicy::DirectiveType& effectiveType,
     const String& consoleMessage,
     const KURL& blockedURL,
     LocalFrame* frame) const {
   String message =
       isReportOnly() ? "[Report Only] " + consoleMessage : consoleMessage;
   m_policy->logToConsole(
       ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel, message),
       frame);
-  m_policy->reportViolation(
-      directiveText, effectiveDirective, message, blockedURL, m_reportEndpoints,
-      m_header, m_headerType, ContentSecurityPolicy::URLViolation, frame);
+  m_policy->reportViolation(directiveText, effectiveType, message, blockedURL,
+                            m_reportEndpoints, m_header, m_headerType,
+                            ContentSecurityPolicy::URLViolation, frame);
 }
 
 void CSPDirectiveList::reportViolationWithLocation(
     const String& directiveText,
-    const String& effectiveDirective,
+    const ContentSecurityPolicy::DirectiveType& effectiveType,
     const String& consoleMessage,
     const KURL& blockedURL,
     const String& contextURL,
     const WTF::OrdinalNumber& contextLine,
     Element* element) const {
   String message =
       isReportOnly() ? "[Report Only] " + consoleMessage : consoleMessage;
   m_policy->logToConsole(ConsoleMessage::create(
       SecurityMessageSource, ErrorMessageLevel, message,
       SourceLocation::capture(contextURL, contextLine.oneBasedInt(), 0)));
   m_policy->reportViolation(
-      directiveText, effectiveDirective, message, blockedURL, m_reportEndpoints,
+      directiveText, effectiveType, message, blockedURL, m_reportEndpoints,
       m_header, m_headerType, ContentSecurityPolicy::InlineViolation, nullptr,
       RedirectStatus::NoRedirect, contextLine.oneBasedInt(), element);
 }
 
 void CSPDirectiveList::reportViolationWithState(
     const String& directiveText,
-    const String& effectiveDirective,
+    const ContentSecurityPolicy::DirectiveType& effectiveType,
     const String& message,
     const KURL& blockedURL,
     ScriptState* scriptState,
     const ContentSecurityPolicy::ExceptionStatus exceptionStatus) const {
   String reportMessage = isReportOnly() ? "[Report Only] " + message : message;
   // Print a console message if it won't be redundant with a
   // JavaScript exception that the caller will throw. (Exceptions will
   // never get thrown in report-only mode because the caller won't see
   // a violation.)
   if (isReportOnly() ||
       exceptionStatus == ContentSecurityPolicy::WillNotThrowException) {
     ConsoleMessage* consoleMessage = ConsoleMessage::create(
         SecurityMessageSource, ErrorMessageLevel, reportMessage);
     m_policy->logToConsole(consoleMessage);
   }
-  m_policy->reportViolation(directiveText, effectiveDirective, message,
-                            blockedURL, m_reportEndpoints, m_header,
-                            m_headerType, ContentSecurityPolicy::EvalViolation);
+  m_policy->reportViolation(directiveText, effectiveType, message, blockedURL,
+                            m_reportEndpoints, m_header, m_headerType,
+                            ContentSecurityPolicy::EvalViolation);
 }
 
 bool CSPDirectiveList::checkEval(SourceListDirective* directive) const {
   return !directive || directive->allowEval();
 }
 
 bool CSPDirectiveList::checkInline(SourceListDirective* directive) const {
   return !directive ||
          (directive->allowInline() && !directive->isHashOrNoncePresent());
 }
@@ skipping 14 matching lines @@
 }
 
 bool CSPDirectiveList::checkDynamic(SourceListDirective* directive) const {
   return !directive || directive->allowDynamic();
 }
 
 void CSPDirectiveList::reportMixedContent(
     const KURL& mixedURL,
     ResourceRequest::RedirectStatus redirectStatus) const {
   if (strictMixedContentChecking()) {
-    m_policy->reportViolation(ContentSecurityPolicy::BlockAllMixedContent,
-                              ContentSecurityPolicy::BlockAllMixedContent,
-                              String(), mixedURL, m_reportEndpoints, m_header,
-                              m_headerType, ContentSecurityPolicy::URLViolation,
-                              nullptr, redirectStatus);
+    m_policy->reportViolation(
+        ContentSecurityPolicy::getDirectiveName(
+            ContentSecurityPolicy::DirectiveType::BlockAllMixedContent),
+        ContentSecurityPolicy::DirectiveType::BlockAllMixedContent, String(),
+        mixedURL, m_reportEndpoints, m_header, m_headerType,
+        ContentSecurityPolicy::URLViolation, nullptr, redirectStatus);
   }
 }
 
 bool CSPDirectiveList::checkSource(
     SourceListDirective* directive,
     const KURL& url,
     ResourceRequest::RedirectStatus redirectStatus) const {
   // If |url| is empty, fall back to the policy URL to ensure that <object>'s
   // without a `src` can be blocked/allowed, as they can still load plugins
   // even though they don't actually have a URL.
@@ skipping 66 matching lines @@
     case WebURLRequest::RequestContextSharedWorker:
       resourceType = "shared worker";
       break;
     case WebURLRequest::RequestContextWorker:
       resourceType = "worker";
       break;
     default:
       break;
   }
 
-  reportViolation(ContentSecurityPolicy::RequireSRIFor,
-                  ContentSecurityPolicy::RequireSRIFor,
+  reportViolation(ContentSecurityPolicy::getDirectiveName(
+                      ContentSecurityPolicy::DirectiveType::RequireSRIFor),
+                  ContentSecurityPolicy::DirectiveType::RequireSRIFor,
                   "Refused to load the " + resourceType + " '" +
                       url.elidedString() +
                       "' because 'require-sri-for' directive requires "
                       "integrity attribute be present for all " +
                       resourceType + "s.",
                   url, redirectStatus);
   return denyIfEnforcingPolicy();
 }
 
 bool CSPDirectiveList::allowRequestWithoutIntegrity(
@@ skipping 36 matching lines @@
   if (checkEval(directive))
     return true;
 
   String suffix = String();
   if (directive == m_defaultSrc)
     suffix =
         " Note that 'script-src' was not explicitly set, so 'default-src' is "
         "used as a fallback.";
 
   reportViolationWithState(
-      directive->text(), ContentSecurityPolicy::ScriptSrc,
+      directive->text(), ContentSecurityPolicy::DirectiveType::ScriptSrc,
       consoleMessage + "\"" + directive->text() + "\"." + suffix + "\n", KURL(),
       scriptState, exceptionStatus);
   if (!isReportOnly()) {
     m_policy->reportBlockedScriptExecutionToInspector(directive->text());
     return false;
   }
   return true;
 }
 
 bool CSPDirectiveList::checkMediaTypeAndReportViolation(
     MediaListDirective* directive,
     const String& type,
     const String& typeAttribute,
     const String& consoleMessage) const {
   if (checkMediaType(directive, type, typeAttribute))
     return true;
 
   String message = consoleMessage + "\'" + directive->text() + "\'.";
   if (typeAttribute.isEmpty())
     message = message +
               " When enforcing the 'plugin-types' directive, the plugin's "
               "media type must be explicitly declared with a 'type' attribute "
               "on the containing element (e.g. '<object type=\"[TYPE GOES "
               "HERE]\" ...>').";
 
   // 'RedirectStatus::NoRedirect' is safe here, as we do the media type check
   // before actually loading data; this means that we shouldn't leak redirect
   // targets, as we won't have had a chance to redirect yet.
-  reportViolation(directive->text(), ContentSecurityPolicy::PluginTypes,
-                  message + "\n", KURL(),
-                  ResourceRequest::RedirectStatus::NoRedirect);
+  reportViolation(
+      directive->text(), ContentSecurityPolicy::DirectiveType::PluginTypes,
+      message + "\n", KURL(), ResourceRequest::RedirectStatus::NoRedirect);
   return denyIfEnforcingPolicy();
 }
 
 bool CSPDirectiveList::checkInlineAndReportViolation(
     SourceListDirective* directive,
     const String& consoleMessage,
     Element* element,
     const String& contextURL,
     const WTF::OrdinalNumber& contextLine,
     bool isScript,
@@ skipping 13 matching lines @@
         " Either the 'unsafe-inline' keyword, a hash ('" + hashValue +
         "'), or a nonce ('nonce-...') is required to enable inline execution.";
     if (directive == m_defaultSrc)
       suffix = suffix + " Note also that '" +
                String(isScript ? "script" : "style") +
                "-src' was not explicitly set, so 'default-src' is used as a "
                "fallback.";
   }
 
   reportViolationWithLocation(
-      directive->text(), isScript ? ContentSecurityPolicy::ScriptSrc
-                                  : ContentSecurityPolicy::StyleSrc,
+      directive->text(),
+      isScript ? ContentSecurityPolicy::DirectiveType::ScriptSrc
+               : ContentSecurityPolicy::DirectiveType::StyleSrc,
       consoleMessage + "\"" + directive->text() + "\"." + suffix + "\n", KURL(),
       contextURL, contextLine, element);
 
   if (!isReportOnly()) {
     if (isScript)
       m_policy->reportBlockedScriptExecutionToInspector(directive->text());
     return false;
   }
   return true;
 }
 
 bool CSPDirectiveList::checkSourceAndReportViolation(
     SourceListDirective* directive,
     const KURL& url,
-    const String& effectiveDirective,
+    const ContentSecurityPolicy::DirectiveType& effectiveType,
     ResourceRequest::RedirectStatus redirectStatus) const {
   if (!directive)
     return true;
 
   // We ignore URL-based whitelists if we're allowing dynamic script injection.
   if (checkSource(directive, url, redirectStatus) && !checkDynamic(directive))
     return true;
 
   // We should never have a violation against `child-src` or `default-src`
   // directly; the effective directive should always be one of the explicit
   // fetch directives.
-  DCHECK_NE(ContentSecurityPolicy::ChildSrc, effectiveDirective);
-  DCHECK_NE(ContentSecurityPolicy::DefaultSrc, effectiveDirective);
+  DCHECK_NE(ContentSecurityPolicy::DirectiveType::ChildSrc, effectiveType);
+  DCHECK_NE(ContentSecurityPolicy::DirectiveType::DefaultSrc, effectiveType);
 
   String prefix;
-  if (ContentSecurityPolicy::BaseURI == effectiveDirective)
+  if (ContentSecurityPolicy::DirectiveType::BaseURI == effectiveType)
     prefix = "Refused to set the document's base URI to '";
-  else if (ContentSecurityPolicy::WorkerSrc == effectiveDirective)
+  else if (ContentSecurityPolicy::DirectiveType::WorkerSrc == effectiveType)
     prefix = "Refused to create a worker from '";
-  else if (ContentSecurityPolicy::ConnectSrc == effectiveDirective)
+  else if (ContentSecurityPolicy::DirectiveType::ConnectSrc == effectiveType)
     prefix = "Refused to connect to '";
-  else if (ContentSecurityPolicy::FontSrc == effectiveDirective)
+  else if (ContentSecurityPolicy::DirectiveType::FontSrc == effectiveType)
     prefix = "Refused to load the font '";
-  else if (ContentSecurityPolicy::FormAction == effectiveDirective)
+  else if (ContentSecurityPolicy::DirectiveType::FormAction == effectiveType)
     prefix = "Refused to send form data to '";
-  else if (ContentSecurityPolicy::FrameSrc == effectiveDirective)
+  else if (ContentSecurityPolicy::DirectiveType::FrameSrc == effectiveType)
     prefix = "Refused to frame '";
-  else if (ContentSecurityPolicy::ImgSrc == effectiveDirective)
+  else if (ContentSecurityPolicy::DirectiveType::ImgSrc == effectiveType)
     prefix = "Refused to load the image '";
-  else if (ContentSecurityPolicy::MediaSrc == effectiveDirective)
+  else if (ContentSecurityPolicy::DirectiveType::MediaSrc == effectiveType)
     prefix = "Refused to load media from '";
-  else if (ContentSecurityPolicy::ManifestSrc == effectiveDirective)
+  else if (ContentSecurityPolicy::DirectiveType::ManifestSrc == effectiveType)
     prefix = "Refused to load manifest from '";
-  else if (ContentSecurityPolicy::ObjectSrc == effectiveDirective)
+  else if (ContentSecurityPolicy::DirectiveType::ObjectSrc == effectiveType)
     prefix = "Refused to load plugin data from '";
-  else if (ContentSecurityPolicy::ScriptSrc == effectiveDirective)
+  else if (ContentSecurityPolicy::DirectiveType::ScriptSrc == effectiveType)
     prefix = "Refused to load the script '";
-  else if (ContentSecurityPolicy::StyleSrc == effectiveDirective)
+  else if (ContentSecurityPolicy::DirectiveType::StyleSrc == effectiveType)
     prefix = "Refused to load the stylesheet '";
 
   String suffix = String();
   if (checkDynamic(directive))
     suffix =
         " 'strict-dynamic' is present, so host-based whitelisting is disabled.";
   if (directive == m_defaultSrc)
     suffix =
-        suffix + " Note that '" + effectiveDirective +
+        suffix + " Note that '" +
+        ContentSecurityPolicy::getDirectiveName(effectiveType) +
         "' was not explicitly set, so 'default-src' is used as a fallback.";
 
-  reportViolation(directive->text(), effectiveDirective,
+  reportViolation(directive->text(), effectiveType,
                   prefix + url.elidedString() +
                       "' because it violates the following Content Security "
                       "Policy directive: \"" +
                       directive->text() + "\"." + suffix + "\n",
                   url, redirectStatus);
   return denyIfEnforcingPolicy();
 }
 
 bool CSPDirectiveList::checkAncestorsAndReportViolation(
     SourceListDirective* directive,
     LocalFrame* frame,
     const KURL& url) const {
   if (checkAncestors(directive, frame))
     return true;
 
-  reportViolationWithFrame(directive->text(), "frame-ancestors",
+  reportViolationWithFrame(directive->text(),
+                           ContentSecurityPolicy::DirectiveType::FrameAncestors,
                            "Refused to display '" + url.elidedString() +
                                "' in a frame because an ancestor violates the "
                                "following Content Security Policy directive: "
                                "\"" +
                                directive->text() + "\".",
                            url, frame);
   return denyIfEnforcingPolicy();
 }
 
 bool CSPDirectiveList::allowJavaScriptURLs(
@@ skipping 105 matching lines @@
     ParserDisposition parserDisposition,
     ResourceRequest::RedirectStatus redirectStatus,
     ContentSecurityPolicy::ReportingStatus reportingStatus) const {
   if (isMatchingNoncePresent(operativeDirective(m_scriptSrc.get()), nonce))
     return true;
   if (parserDisposition == NotParserInserted && allowDynamic())
     return true;
   return reportingStatus == ContentSecurityPolicy::SendReport
              ? checkSourceAndReportViolation(
                    operativeDirective(m_scriptSrc.get()), url,
-                   ContentSecurityPolicy::ScriptSrc, redirectStatus)
+                   ContentSecurityPolicy::DirectiveType::ScriptSrc,
+                   redirectStatus)
              : checkSource(operativeDirective(m_scriptSrc.get()), url,
                            redirectStatus);
 }
 
 bool CSPDirectiveList::allowObjectFromSource(
     const KURL& url,
     ResourceRequest::RedirectStatus redirectStatus,
     ContentSecurityPolicy::ReportingStatus reportingStatus) const {
   if (url.protocolIsAbout())
     return true;
   return reportingStatus == ContentSecurityPolicy::SendReport
              ? checkSourceAndReportViolation(
                    operativeDirective(m_objectSrc.get()), url,
-                   ContentSecurityPolicy::ObjectSrc, redirectStatus)
+                   ContentSecurityPolicy::DirectiveType::ObjectSrc,
+                   redirectStatus)
              : checkSource(operativeDirective(m_objectSrc.get()), url,
                            redirectStatus);
 }
 
 bool CSPDirectiveList::allowFrameFromSource(
     const KURL& url,
     ResourceRequest::RedirectStatus redirectStatus,
     ContentSecurityPolicy::ReportingStatus reportingStatus) const {
   if (url.protocolIsAbout())
     return true;
 
   // 'frame-src' overrides 'child-src', which overrides the default
   // sources. So, we do this nested set of calls to 'operativeDirective()' to
   // grab 'frame-src' if it exists, 'child-src' if it doesn't, and 'defaut-src'
   // if neither are available.
   SourceListDirective* whichDirective = operativeDirective(
       m_frameSrc.get(), operativeDirective(m_childSrc.get()));
 
   return reportingStatus == ContentSecurityPolicy::SendReport
-             ? checkSourceAndReportViolation(whichDirective, url,
-                                             ContentSecurityPolicy::FrameSrc,
-                                             redirectStatus)
+             ? checkSourceAndReportViolation(
+                   whichDirective, url,
+                   ContentSecurityPolicy::DirectiveType::FrameSrc,
+                   redirectStatus)
              : checkSource(whichDirective, url, redirectStatus);
 }
 
 bool CSPDirectiveList::allowImageFromSource(
     const KURL& url,
     ResourceRequest::RedirectStatus redirectStatus,
     ContentSecurityPolicy::ReportingStatus reportingStatus) const {
   return reportingStatus == ContentSecurityPolicy::SendReport
-             ? checkSourceAndReportViolation(operativeDirective(m_imgSrc.get()),
-                                             url, ContentSecurityPolicy::ImgSrc,
-                                             redirectStatus)
+             ? checkSourceAndReportViolation(
+                   operativeDirective(m_imgSrc.get()), url,
+                   ContentSecurityPolicy::DirectiveType::ImgSrc, redirectStatus)
              : checkSource(operativeDirective(m_imgSrc.get()), url,
                            redirectStatus);
 }
 
 bool CSPDirectiveList::allowStyleFromSource(
     const KURL& url,
     const String& nonce,
     ResourceRequest::RedirectStatus redirectStatus,
     ContentSecurityPolicy::ReportingStatus reportingStatus) const {
   if (isMatchingNoncePresent(operativeDirective(m_styleSrc.get()), nonce))
     return true;
   return reportingStatus == ContentSecurityPolicy::SendReport
              ? checkSourceAndReportViolation(
                    operativeDirective(m_styleSrc.get()), url,
-                   ContentSecurityPolicy::StyleSrc, redirectStatus)
+                   ContentSecurityPolicy::DirectiveType::StyleSrc,
+                   redirectStatus)
              : checkSource(operativeDirective(m_styleSrc.get()), url,
                            redirectStatus);
 }
 
 bool CSPDirectiveList::allowFontFromSource(
     const KURL& url,
     ResourceRequest::RedirectStatus redirectStatus,
     ContentSecurityPolicy::ReportingStatus reportingStatus) const {
   return reportingStatus == ContentSecurityPolicy::SendReport
              ? checkSourceAndReportViolation(
                    operativeDirective(m_fontSrc.get()), url,
-                   ContentSecurityPolicy::FontSrc, redirectStatus)
+                   ContentSecurityPolicy::DirectiveType::FontSrc,
+                   redirectStatus)
              : checkSource(operativeDirective(m_fontSrc.get()), url,
                            redirectStatus);
 }
 
 bool CSPDirectiveList::allowMediaFromSource(
     const KURL& url,
     ResourceRequest::RedirectStatus redirectStatus,
     ContentSecurityPolicy::ReportingStatus reportingStatus) const {
   return reportingStatus == ContentSecurityPolicy::SendReport
              ? checkSourceAndReportViolation(
                    operativeDirective(m_mediaSrc.get()), url,
-                   ContentSecurityPolicy::MediaSrc, redirectStatus)
+                   ContentSecurityPolicy::DirectiveType::MediaSrc,
+                   redirectStatus)
              : checkSource(operativeDirective(m_mediaSrc.get()), url,
                            redirectStatus);
 }
 
 bool CSPDirectiveList::allowManifestFromSource(
     const KURL& url,
     ResourceRequest::RedirectStatus redirectStatus,
     ContentSecurityPolicy::ReportingStatus reportingStatus) const {
   return reportingStatus == ContentSecurityPolicy::SendReport
              ? checkSourceAndReportViolation(
                    operativeDirective(m_manifestSrc.get()), url,
-                   ContentSecurityPolicy::ManifestSrc, redirectStatus)
+                   ContentSecurityPolicy::DirectiveType::ManifestSrc,
+                   redirectStatus)
              : checkSource(operativeDirective(m_manifestSrc.get()), url,
                            redirectStatus);
 }
 
 bool CSPDirectiveList::allowConnectToSource(
     const KURL& url,
     ResourceRequest::RedirectStatus redirectStatus,
     ContentSecurityPolicy::ReportingStatus reportingStatus) const {
   return reportingStatus == ContentSecurityPolicy::SendReport
              ? checkSourceAndReportViolation(
                    operativeDirective(m_connectSrc.get()), url,
-                   ContentSecurityPolicy::ConnectSrc, redirectStatus)
+                   ContentSecurityPolicy::DirectiveType::ConnectSrc,
+                   redirectStatus)
              : checkSource(operativeDirective(m_connectSrc.get()), url,
                            redirectStatus);
 }
 
 bool CSPDirectiveList::allowFormAction(
     const KURL& url,
     ResourceRequest::RedirectStatus redirectStatus,
     ContentSecurityPolicy::ReportingStatus reportingStatus) const {
   return reportingStatus == ContentSecurityPolicy::SendReport
-             ? checkSourceAndReportViolation(m_formAction.get(), url,
-                                             ContentSecurityPolicy::FormAction,
-                                             redirectStatus)
+             ? checkSourceAndReportViolation(
+                   m_formAction.get(), url,
+                   ContentSecurityPolicy::DirectiveType::FormAction,
+                   redirectStatus)
              : checkSource(m_formAction.get(), url, redirectStatus);
 }
 
 bool CSPDirectiveList::allowBaseURI(
     const KURL& url,
     ResourceRequest::RedirectStatus redirectStatus,
     ContentSecurityPolicy::ReportingStatus reportingStatus) const {
   return reportingStatus == ContentSecurityPolicy::SendReport
-             ? checkSourceAndReportViolation(m_baseURI.get(), url,
-                                             ContentSecurityPolicy::BaseURI,
-                                             redirectStatus)
+             ? checkSourceAndReportViolation(
+                   m_baseURI.get(), url,
+                   ContentSecurityPolicy::DirectiveType::BaseURI,
+                   redirectStatus)
              : checkSource(m_baseURI.get(), url, redirectStatus);
 }
 
 bool CSPDirectiveList::allowWorkerFromSource(
     const KURL& url,
     ResourceRequest::RedirectStatus redirectStatus,
     ContentSecurityPolicy::ReportingStatus reportingStatus) const {
   // 'worker-src' overrides 'child-src', which overrides the default
   // sources. So, we do this nested set of calls to 'operativeDirective()' to
   // grab 'worker-src' if it exists, 'child-src' if it doesn't, and 'defaut-src'
   // if neither are available.
   SourceListDirective* whichDirective = operativeDirective(
       m_workerSrc.get(), operativeDirective(m_childSrc.get()));
 
   return reportingStatus == ContentSecurityPolicy::SendReport
-             ? checkSourceAndReportViolation(whichDirective, url,
-                                             ContentSecurityPolicy::WorkerSrc,
-                                             redirectStatus)
+             ? checkSourceAndReportViolation(
+                   whichDirective, url,
+                   ContentSecurityPolicy::DirectiveType::WorkerSrc,
+                   redirectStatus)
              : checkSource(whichDirective, url, redirectStatus);
 }
 
 bool CSPDirectiveList::allowAncestors(
     LocalFrame* frame,
     const KURL& url,
     ContentSecurityPolicy::ReportingStatus reportingStatus) const {
   return reportingStatus == ContentSecurityPolicy::SendReport
              ? checkAncestorsAndReportViolation(m_frameAncestors.get(), frame,
                                                 url)
@@ skipping 212 matching lines @@
                                        const String& value,
                                        Member<CSPDirectiveType>& directive) {
   if (directive) {
     m_policy->reportDuplicateDirective(name);
     return;
   }
 
   // Remove frame-ancestors directives in meta policies, per
   // https://www.w3.org/TR/CSP2/#delivery-html-meta-element.
   if (m_headerSource == ContentSecurityPolicyHeaderSourceMeta &&
-      name == ContentSecurityPolicy::FrameAncestors) {
+      ContentSecurityPolicy::getDirectiveType(name) ==
+          ContentSecurityPolicy::DirectiveType::FrameAncestors) {
     m_policy->reportInvalidDirectiveInMeta(name);
     return;
   }
 
   directive = new CSPDirectiveType(name, value, m_policy);
 }
 
 void CSPDirectiveList::applySandboxPolicy(const String& name,
                                           const String& sandboxPolicy) {
   // Remove sandbox directives in meta policies, per
@@ skipping 64 matching lines @@
   m_upgradeInsecureRequests = true;
 
   m_policy->upgradeInsecureRequests();
   if (!value.isEmpty())
     m_policy->reportValueForEmptyDirective(name, value);
 }
 
 void CSPDirectiveList::addDirective(const String& name, const String& value) {
   ASSERT(!name.isEmpty());
 
-  if (equalIgnoringCase(name, ContentSecurityPolicy::DefaultSrc)) {
+  ContentSecurityPolicy::DirectiveType type =
+      ContentSecurityPolicy::getDirectiveType(name);
+  if (type == ContentSecurityPolicy::DirectiveType::DefaultSrc) {
     setCSPDirective<SourceListDirective>(name, value, m_defaultSrc);
     // TODO(mkwst) It seems unlikely that developers would use different
     // algorithms for scripts and styles. We may want to combine the
     // usesScriptHashAlgorithms() and usesStyleHashAlgorithms.
     m_policy->usesScriptHashAlgorithms(m_defaultSrc->hashAlgorithmsUsed());
     m_policy->usesStyleHashAlgorithms(m_defaultSrc->hashAlgorithmsUsed());
-  } else if (equalIgnoringCase(name, ContentSecurityPolicy::ScriptSrc)) {
+  } else if (type == ContentSecurityPolicy::DirectiveType::ScriptSrc) {
     setCSPDirective<SourceListDirective>(name, value, m_scriptSrc);
     m_policy->usesScriptHashAlgorithms(m_scriptSrc->hashAlgorithmsUsed());
-  } else if (equalIgnoringCase(name, ContentSecurityPolicy::ObjectSrc)) {
+  } else if (type == ContentSecurityPolicy::DirectiveType::ObjectSrc) {
     setCSPDirective<SourceListDirective>(name, value, m_objectSrc);
-  } else if (equalIgnoringCase(name, ContentSecurityPolicy::FrameAncestors)) {
+  } else if (type ==
+
+             ContentSecurityPolicy::DirectiveType::FrameAncestors) {
     setCSPDirective<SourceListDirective>(name, value, m_frameAncestors);
-  } else if (equalIgnoringCase(name, ContentSecurityPolicy::FrameSrc)) {
+  } else if (type == ContentSecurityPolicy::DirectiveType::FrameSrc) {
     setCSPDirective<SourceListDirective>(name, value, m_frameSrc);
-  } else if (equalIgnoringCase(name, ContentSecurityPolicy::ImgSrc)) {
+  } else if (type == ContentSecurityPolicy::DirectiveType::ImgSrc) {
     setCSPDirective<SourceListDirective>(name, value, m_imgSrc);
-  } else if (equalIgnoringCase(name, ContentSecurityPolicy::StyleSrc)) {
+  } else if (type == ContentSecurityPolicy::DirectiveType::StyleSrc) {
     setCSPDirective<SourceListDirective>(name, value, m_styleSrc);
     m_policy->usesStyleHashAlgorithms(m_styleSrc->hashAlgorithmsUsed());
-  } else if (equalIgnoringCase(name, ContentSecurityPolicy::FontSrc)) {
+  } else if (type == ContentSecurityPolicy::DirectiveType::FontSrc) {
     setCSPDirective<SourceListDirective>(name, value, m_fontSrc);
-  } else if (equalIgnoringCase(name, ContentSecurityPolicy::MediaSrc)) {
+  } else if (type == ContentSecurityPolicy::DirectiveType::MediaSrc) {
     setCSPDirective<SourceListDirective>(name, value, m_mediaSrc);
-  } else if (equalIgnoringCase(name, ContentSecurityPolicy::ConnectSrc)) {
+  } else if (type == ContentSecurityPolicy::DirectiveType::ConnectSrc) {
     setCSPDirective<SourceListDirective>(name, value, m_connectSrc);
-  } else if (equalIgnoringCase(name, ContentSecurityPolicy::Sandbox)) {
+  } else if (type == ContentSecurityPolicy::DirectiveType::Sandbox) {
     applySandboxPolicy(name, value);
-  } else if (equalIgnoringCase(name, ContentSecurityPolicy::ReportURI)) {
+  } else if (type == ContentSecurityPolicy::DirectiveType::ReportURI) {
     parseReportURI(name, value);
-  } else if (equalIgnoringCase(name, ContentSecurityPolicy::BaseURI)) {
+  } else if (type == ContentSecurityPolicy::DirectiveType::BaseURI) {
     setCSPDirective<SourceListDirective>(name, value, m_baseURI);
-  } else if (equalIgnoringCase(name, ContentSecurityPolicy::ChildSrc)) {
+  } else if (type == ContentSecurityPolicy::DirectiveType::ChildSrc) {
     setCSPDirective<SourceListDirective>(name, value, m_childSrc);
-  } else if (equalIgnoringCase(name, ContentSecurityPolicy::WorkerSrc) &&
+  } else if (type == ContentSecurityPolicy::DirectiveType::WorkerSrc &&
              m_policy->experimentalFeaturesEnabled()) {
     setCSPDirective<SourceListDirective>(name, value, m_workerSrc);
-  } else if (equalIgnoringCase(name, ContentSecurityPolicy::FormAction)) {
+  } else if (type == ContentSecurityPolicy::DirectiveType::FormAction) {
     setCSPDirective<SourceListDirective>(name, value, m_formAction);
-  } else if (equalIgnoringCase(name, ContentSecurityPolicy::PluginTypes)) {
+  } else if (type == ContentSecurityPolicy::DirectiveType::PluginTypes) {
     setCSPDirective<MediaListDirective>(name, value, m_pluginTypes);
-  } else if (equalIgnoringCase(
-                 name, ContentSecurityPolicy::UpgradeInsecureRequests)) {
+  } else if (type ==
+             ContentSecurityPolicy::DirectiveType::UpgradeInsecureRequests) {
     enableInsecureRequestsUpgrade(name, value);
-  } else if (equalIgnoringCase(name,
-                               ContentSecurityPolicy::BlockAllMixedContent)) {
+  } else if (type ==
+             ContentSecurityPolicy::DirectiveType::BlockAllMixedContent) {
     enforceStrictMixedContentChecking(name, value);
-  } else if (equalIgnoringCase(name, ContentSecurityPolicy::ManifestSrc)) {
+  } else if (type == ContentSecurityPolicy::DirectiveType::ManifestSrc) {
     setCSPDirective<SourceListDirective>(name, value, m_manifestSrc);
-  } else if (equalIgnoringCase(name,
-                               ContentSecurityPolicy::TreatAsPublicAddress)) {
+  } else if (type ==
+             ContentSecurityPolicy::DirectiveType::TreatAsPublicAddress) {
     treatAsPublicAddress(name, value);
-  } else if (equalIgnoringCase(name, ContentSecurityPolicy::RequireSRIFor) &&
+  } else if (type == ContentSecurityPolicy::DirectiveType::RequireSRIFor &&
              m_policy->experimentalFeaturesEnabled()) {
     parseRequireSRIFor(name, value);
   } else {
     m_policy->reportUnsupportedDirective(name);
   }
 }
 
 DEFINE_TRACE(CSPDirectiveList) {
   visitor->trace(m_policy);
   visitor->trace(m_pluginTypes);
   visitor->trace(m_baseURI);
   visitor->trace(m_childSrc);
   visitor->trace(m_connectSrc);
   visitor->trace(m_defaultSrc);
   visitor->trace(m_fontSrc);
   visitor->trace(m_formAction);
   visitor->trace(m_frameAncestors);
   visitor->trace(m_frameSrc);
   visitor->trace(m_imgSrc);
   visitor->trace(m_mediaSrc);
   visitor->trace(m_manifestSrc);
   visitor->trace(m_objectSrc);
   visitor->trace(m_scriptSrc);
   visitor->trace(m_styleSrc);
   visitor->trace(m_workerSrc);
 }
 
 }  // namespace blink