Fix iframe security policy directives for viewing isolate content

appengine/isolate/handlers_frontend.py

 # Copyright 2012 The LUCI Authors. All rights reserved.
 # Use of this source code is governed under the Apache License, Version 2.0
 # that can be found in the LICENSE file.
 
 """This module defines Isolate Server frontend url handlers."""
 
 import cgi
 import datetime
 import json
 import logging
@@ skipping 187 matching lines @@
     # Check for existence of element, so we can 400/404
     if digest and namespace:
       try:
         model.get_content(namespace, digest)
       except ValueError:
         self.abort(400, 'Invalid key')
       except LookupError:
         self.abort(404, 'Unable to retrieve the entry')
     self.response.write(template.render('isolate/browse.html', params))
 
+  def get_content_security_policy(self):
+    csp = super(BrowseHandler, self).get_content_security_policy()
+    csp.setdefault('child-src', []).append("'self'")
+    return csp
+
 
 class ContentHandler(auth.AuthenticatingHandler):
   @auth.autologin
   @auth.require(acl.isolate_readable)
   def get(self):
     namespace = self.request.get('namespace', 'default-gzip')
     digest = self.request.get('digest', '')
     content = None
 
     if digest and namespace:
@@ skipping 55 matching lines @@
             content = re.sub(r'([0-9a-f]{40})',
               r'<a target="_blank" href="/browse?namespace=%s' % namespace +
                 r'&digest=\1">\1</a>',
               content)
             self.response.headers['Content-Type'] = 'text/html; charset=utf-8'
           except ValueError:
             pass
 
     self.response.write(content)
 
-

[M-A Ruel, 2017/02/09 21:37:09]

add back, we keep two empty lines between file level symbols.

[jonesmi, 2017/02/09 21:49:04]

Done.

 class StatsHandler(webapp2.RequestHandler):
   """Returns the statistics web page."""
   def get(self):
     """Presents nice recent statistics.
 
     It fetches data from the 'JSON' API.
     """
     # Preloads the data to save a complete request.
     resolution = self.request.params.get('resolution', 'hours')
     if resolution not in ('days', 'hours', 'minutes'):
@@ skipping 113 matching lines @@
 def create_application(debug):
   """Creates the url router.
 
   The basic layouts is as follow:
   - /restricted/.* requires being an instance administrator.
   - /stats/.* has statistics.
   """
   acl.bootstrap()
   template.bootstrap()
   return webapp2.WSGIApplication(get_routes(), debug=debug)