Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(99)

Side by Side Diff: third_party/WebKit/Source/core/frame/csp/SourceListDirective.cpp

Issue 2551843002: Embedding-CSP: Adding `const` to method signatures. (Closed)
Patch Set: Rebasing Created 4 years ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « third_party/WebKit/Source/core/frame/csp/SourceListDirective.h ('k') | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright 2014 The Chromium Authors. All rights reserved. 1 // Copyright 2014 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "core/frame/csp/SourceListDirective.h" 5 #include "core/frame/csp/SourceListDirective.h"
6 6
7 #include "core/frame/csp/CSPSource.h" 7 #include "core/frame/csp/CSPSource.h"
8 #include "core/frame/csp/ContentSecurityPolicy.h" 8 #include "core/frame/csp/ContentSecurityPolicy.h"
9 #include "platform/network/ContentSecurityPolicyParsers.h" 9 #include "platform/network/ContentSecurityPolicyParsers.h"
10 #include "platform/weborigin/KURL.h" 10 #include "platform/weborigin/KURL.h"
(...skipping 568 matching lines...) Expand 10 before | Expand all | Expand 10 after
579 const KURL& url, 579 const KURL& url,
580 ResourceRequest::RedirectStatus redirectStatus) const { 580 ResourceRequest::RedirectStatus redirectStatus) const {
581 for (size_t i = 0; i < m_list.size(); ++i) { 581 for (size_t i = 0; i < m_list.size(); ++i) {
582 if (m_list[i]->matches(url, redirectStatus)) 582 if (m_list[i]->matches(url, redirectStatus))
583 return true; 583 return true;
584 } 584 }
585 585
586 return false; 586 return false;
587 } 587 }
588 588
589 bool SourceListDirective::allowAllInline() { 589 bool SourceListDirective::allowAllInline() const {
590 const ContentSecurityPolicy::DirectiveType& type = 590 const ContentSecurityPolicy::DirectiveType& type =
591 ContentSecurityPolicy::getDirectiveType(m_directiveName); 591 ContentSecurityPolicy::getDirectiveType(m_directiveName);
592 if (type != ContentSecurityPolicy::DirectiveType::DefaultSrc && 592 if (type != ContentSecurityPolicy::DirectiveType::DefaultSrc &&
593 type != ContentSecurityPolicy::DirectiveType::StyleSrc && 593 type != ContentSecurityPolicy::DirectiveType::StyleSrc &&
594 type != ContentSecurityPolicy::DirectiveType::ScriptSrc) { 594 type != ContentSecurityPolicy::DirectiveType::ScriptSrc) {
595 return false; 595 return false;
596 } 596 }
597 return m_allowInline && !isHashOrNoncePresent() && 597 return m_allowInline && !isHashOrNoncePresent() &&
598 (type != ContentSecurityPolicy::DirectiveType::ScriptSrc || 598 (type != ContentSecurityPolicy::DirectiveType::ScriptSrc ||
599 !m_allowDynamic); 599 !m_allowDynamic);
600 } 600 }
601 601
602 bool SourceListDirective::subsumes( 602 bool SourceListDirective::subsumes(
603 HeapVector<Member<SourceListDirective>> other) { 603 const HeapVector<Member<SourceListDirective>>& other) const {
604 // TODO(amalika): Handle here special keywords. 604 // TODO(amalika): Handle here special keywords.
605 if (!other.size() || other[0]->isNone()) 605 if (!other.size() || other[0]->isNone())
606 return other.size(); 606 return other.size();
607 607
608 HeapVector<Member<CSPSource>> normalizedA = m_list; 608 HeapVector<Member<CSPSource>> normalizedA = m_list;
609 if (m_allowSelf && other[0]->m_policy->getSelfSource()) 609 if (m_allowSelf && other[0]->m_policy->getSelfSource())
610 normalizedA.append(other[0]->m_policy->getSelfSource()); 610 normalizedA.append(other[0]->m_policy->getSelfSource());
611 611
612 HeapVector<Member<CSPSource>> normalizedB = other[0]->m_list; 612 HeapVector<Member<CSPSource>> normalizedB = other[0]->m_list;
613 if (other[0]->m_allowSelf && other[0]->m_policy->getSelfSource()) 613 if (other[0]->m_allowSelf && other[0]->m_policy->getSelfSource())
(...skipping 30 matching lines...) Expand all
644 !allowDynamicOther); 644 !allowDynamicOther);
645 if (!allowAllInline() && allowAllInlineOther) 645 if (!allowAllInline() && allowAllInlineOther)
646 return false; 646 return false;
647 } 647 }
648 648
649 return CSPSource::firstSubsumesSecond(normalizedA, normalizedB); 649 return CSPSource::firstSubsumesSecond(normalizedA, normalizedB);
650 } 650 }
651 651
652 HeapHashMap<String, Member<CSPSource>> 652 HeapHashMap<String, Member<CSPSource>>
653 SourceListDirective::getIntersectSchemesOnly( 653 SourceListDirective::getIntersectSchemesOnly(
654 HeapVector<Member<CSPSource>> other) { 654 const HeapVector<Member<CSPSource>>& other) const {
655 HeapHashMap<String, Member<CSPSource>> schemesA; 655 HeapHashMap<String, Member<CSPSource>> schemesA;
656 for (const auto& sourceA : m_list) { 656 for (const auto& sourceA : m_list) {
657 if (sourceA->isSchemeOnly()) 657 if (sourceA->isSchemeOnly())
658 addSourceToMap(schemesA, sourceA); 658 addSourceToMap(schemesA, sourceA);
659 } 659 }
660 // Add schemes only sources if they are present in both `this` and `other`, 660 // Add schemes only sources if they are present in both `this` and `other`,
661 // allowing upgrading `http` to `https` and `ws` to `wss`. 661 // allowing upgrading `http` to `https` and `ws` to `wss`.
662 HeapHashMap<String, Member<CSPSource>> intersect; 662 HeapHashMap<String, Member<CSPSource>> intersect;
663 for (const auto& sourceB : other) { 663 for (const auto& sourceB : other) {
664 if (sourceB->isSchemeOnly()) { 664 if (sourceB->isSchemeOnly()) {
665 if (schemesA.contains(sourceB->getScheme())) 665 if (schemesA.contains(sourceB->getScheme()))
666 addSourceToMap(intersect, sourceB); 666 addSourceToMap(intersect, sourceB);
667 else if (sourceB->getScheme() == "http" && schemesA.contains("https")) 667 else if (sourceB->getScheme() == "http" && schemesA.contains("https"))
668 intersect.add("https", schemesA.get("https")); 668 intersect.add("https", schemesA.get("https"));
669 else if (sourceB->getScheme() == "ws" && schemesA.contains("wss")) 669 else if (sourceB->getScheme() == "ws" && schemesA.contains("wss"))
670 intersect.add("wss", schemesA.get("wss")); 670 intersect.add("wss", schemesA.get("wss"));
671 } 671 }
672 } 672 }
673 673
674 return intersect; 674 return intersect;
675 } 675 }
676 676
677 HeapVector<Member<CSPSource>> SourceListDirective::getIntersectCSPSources( 677 HeapVector<Member<CSPSource>> SourceListDirective::getIntersectCSPSources(
678 HeapVector<Member<CSPSource>> other) { 678 const HeapVector<Member<CSPSource>>& other) const {
679 auto schemesMap = getIntersectSchemesOnly(other); 679 auto schemesMap = getIntersectSchemesOnly(other);
680 HeapVector<Member<CSPSource>> normalized; 680 HeapVector<Member<CSPSource>> normalized;
681 // Add all normalized scheme source expressions. 681 // Add all normalized scheme source expressions.
682 for (const auto& it : schemesMap) { 682 for (const auto& it : schemesMap) {
683 // We do not add secure versions if insecure schemes are present. 683 // We do not add secure versions if insecure schemes are present.
684 if ((it.key != "https" || !schemesMap.contains("http")) && 684 if ((it.key != "https" || !schemesMap.contains("http")) &&
685 (it.key != "wss" || !schemesMap.contains("ws"))) { 685 (it.key != "wss" || !schemesMap.contains("ws"))) {
686 normalized.append(it.value); 686 normalized.append(it.value);
687 } 687 }
688 } 688 }
(...skipping 31 matching lines...) Expand 10 before | Expand all | Expand 10 after
720 return normalized; 720 return normalized;
721 } 721 }
722 722
723 DEFINE_TRACE(SourceListDirective) { 723 DEFINE_TRACE(SourceListDirective) {
724 visitor->trace(m_policy); 724 visitor->trace(m_policy);
725 visitor->trace(m_list); 725 visitor->trace(m_list);
726 CSPDirective::trace(visitor); 726 CSPDirective::trace(visitor);
727 } 727 }
728 728
729 } // namespace blink 729 } // namespace blink
OLDNEW
« no previous file with comments | « third_party/WebKit/Source/core/frame/csp/SourceListDirective.h ('k') | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698