OLD | NEW |
1 // Copyright 2017 The Chromium Authors. All rights reserved. | 1 // Copyright 2017 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <sstream> | 5 #include <sstream> |
6 #include "base/strings/string_split.h" | 6 #include "base/strings/string_split.h" |
7 #include "base/strings/string_util.h" | 7 #include "base/strings/string_util.h" |
8 #include "content/common/content_security_policy/csp_context.h" | 8 #include "content/common/content_security_policy/csp_context.h" |
9 | 9 |
10 namespace content { | 10 namespace content { |
(...skipping 23 matching lines...) Expand all Loading... |
34 std::string ElideURLForReportViolation(const GURL& url) { | 34 std::string ElideURLForReportViolation(const GURL& url) { |
35 // TODO(arthursonzogni): the url length should be limited to 1024 char. Find | 35 // TODO(arthursonzogni): the url length should be limited to 1024 char. Find |
36 // a function that will not break the utf8 encoding while eliding the string. | 36 // a function that will not break the utf8 encoding while eliding the string. |
37 return url.spec(); | 37 return url.spec(); |
38 } | 38 } |
39 | 39 |
40 void ReportViolation(CSPContext* context, | 40 void ReportViolation(CSPContext* context, |
41 const ContentSecurityPolicy& policy, | 41 const ContentSecurityPolicy& policy, |
42 const CSPDirective& directive, | 42 const CSPDirective& directive, |
43 const CSPDirective::Name directive_name, | 43 const CSPDirective::Name directive_name, |
44 const GURL& url) { | 44 const GURL& url, |
| 45 bool is_redirect) { |
45 // We should never have a violation against `child-src` or `default-src` | 46 // We should never have a violation against `child-src` or `default-src` |
46 // directly; the effective directive should always be one of the explicit | 47 // directly; the effective directive should always be one of the explicit |
47 // fetch directives. | 48 // fetch directives. |
48 DCHECK_NE(directive_name, CSPDirective::DefaultSrc); | 49 DCHECK_NE(directive_name, CSPDirective::DefaultSrc); |
49 DCHECK_NE(directive_name, CSPDirective::ChildSrc); | 50 DCHECK_NE(directive_name, CSPDirective::ChildSrc); |
50 | 51 |
51 std::stringstream message; | 52 std::stringstream message; |
52 | 53 |
53 if (policy.disposition == blink::WebContentSecurityPolicyTypeReport) | 54 if (policy.disposition == blink::WebContentSecurityPolicyTypeReport) |
54 message << "[Report Only] "; | 55 message << "[Report Only] "; |
(...skipping 10 matching lines...) Expand all Loading... |
65 | 66 |
66 if (directive.name != directive_name) | 67 if (directive.name != directive_name) |
67 message << " Note that '" << CSPDirective::NameToString(directive_name) | 68 message << " Note that '" << CSPDirective::NameToString(directive_name) |
68 << "' was not explicitly set, so '" | 69 << "' was not explicitly set, so '" |
69 << CSPDirective::NameToString(directive.name) | 70 << CSPDirective::NameToString(directive.name) |
70 << "' is used as a fallback."; | 71 << "' is used as a fallback."; |
71 | 72 |
72 message << "\n"; | 73 message << "\n"; |
73 | 74 |
74 context->LogToConsole(message.str()); | 75 context->LogToConsole(message.str()); |
75 context->ReportViolation(CSPDirective::NameToString(directive.name), | 76 |
76 CSPDirective::NameToString(directive_name), | 77 context->ReportContentSecurityPolicyViolation(CSPViolationParams( |
77 message.str(), url, policy.report_endpoints, | 78 CSPDirective::NameToString(directive.name), |
78 policy.header, policy.disposition); | 79 CSPDirective::NameToString(directive_name), message.str(), url, |
| 80 policy.report_endpoints, policy.header, policy.disposition, is_redirect)); |
79 } | 81 } |
80 | 82 |
81 bool AllowDirective(CSPContext* context, | 83 bool AllowDirective(CSPContext* context, |
82 const ContentSecurityPolicy& policy, | 84 const ContentSecurityPolicy& policy, |
83 const CSPDirective& directive, | 85 const CSPDirective& directive, |
84 CSPDirective::Name directive_name, | 86 CSPDirective::Name directive_name, |
85 const GURL& url, | 87 const GURL& url, |
86 bool is_redirect) { | 88 bool is_redirect) { |
87 if (CSPSourceList::Allow(directive.source_list, url, context, is_redirect)) | 89 if (CSPSourceList::Allow(directive.source_list, url, context, is_redirect)) |
88 return true; | 90 return true; |
89 | 91 |
90 ReportViolation(context, policy, directive, directive_name, url); | 92 ReportViolation(context, policy, directive, directive_name, url, is_redirect); |
91 return false; | 93 return false; |
92 } | 94 } |
93 | 95 |
94 } // namespace | 96 } // namespace |
95 | 97 |
96 ContentSecurityPolicy::ContentSecurityPolicy() | 98 ContentSecurityPolicy::ContentSecurityPolicy() |
97 : disposition(blink::WebContentSecurityPolicyTypeEnforce), | 99 : disposition(blink::WebContentSecurityPolicyTypeEnforce), |
98 source(blink::WebContentSecurityPolicySourceHTTP) {} | 100 source(blink::WebContentSecurityPolicySourceHTTP) {} |
99 | 101 |
100 ContentSecurityPolicy::ContentSecurityPolicy( | 102 ContentSecurityPolicy::ContentSecurityPolicy( |
(...skipping 49 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
150 is_first_policy = false; | 152 is_first_policy = false; |
151 text << "report-uri"; | 153 text << "report-uri"; |
152 for (const std::string& endpoint : report_endpoints) | 154 for (const std::string& endpoint : report_endpoints) |
153 text << " " << endpoint; | 155 text << " " << endpoint; |
154 } | 156 } |
155 | 157 |
156 return text.str(); | 158 return text.str(); |
157 } | 159 } |
158 | 160 |
159 } // namespace content | 161 } // namespace content |
OLD | NEW |