Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(70)

Unified Diff: content/browser/frame_host/form_submission_throttle.h

Issue 2689653003: PlzNavigate: Enforce 'form-action' CSP on the browser-side. (Closed)
Patch Set: PlzNavigate: Enforce 'form-action' CSP on the browser-side. Created 3 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: content/browser/frame_host/form_submission_throttle.h
diff --git a/content/browser/frame_host/form_submission_throttle.h b/content/browser/frame_host/form_submission_throttle.h
new file mode 100644
index 0000000000000000000000000000000000000000..d8961092b210ac3f14152e818f16b81013dbcf12
--- /dev/null
+++ b/content/browser/frame_host/form_submission_throttle.h
@@ -0,0 +1,39 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_FRAME_HOST_FORM_SUBMISSION_THROTTLE_H_
+#define CONTENT_BROWSER_FRAME_HOST_FORM_SUBMISSION_THROTTLE_H_
+
+#include <memory>
+#include <string>
+
+#include "base/macros.h"
+#include "content/public/browser/navigation_throttle.h"
+
+namespace content {
+class NavigationHandle;
+
+// A FormSubmittionThrottle is responsible for enforcing the 'form-action' CSP,
+// blocking requests which violate them.
+class CONTENT_EXPORT FormSubmissionThrottle : public NavigationThrottle {
Mike West 2017/02/22 15:36:08 Do you plan on creating a distinct throttle for `f
arthursonzogni 2017/02/22 17:15:23 I am okay with this idea. The throttle is only cre
alexmos 2017/02/28 02:48:46 I'm personally ok either way. Unifying them in on
arthursonzogni 2017/03/07 16:25:51 Yes, nice summary. What to decide for now? I would
nasko 2017/03/09 05:35:16 I would prefer separate ones, unless we have clear
+ public:
+ static std::unique_ptr<NavigationThrottle> MaybeCreateThrottleFor(
+ NavigationHandle* handle);
+
+ ~FormSubmissionThrottle() override;
+
+ NavigationThrottle::ThrottleCheckResult WillStartRequest() override;
+ NavigationThrottle::ThrottleCheckResult WillRedirectRequest() override;
+
+ private:
+ explicit FormSubmissionThrottle(NavigationHandle* handle);
+ NavigationThrottle::ThrottleCheckResult CheckContentSecurityPolicyFormAction(
+ bool is_redirect);
+
+ DISALLOW_COPY_AND_ASSIGN(FormSubmissionThrottle);
+};
+
+} // namespace content
+
+#endif // CONTENT_BROWSER_FRAME_HOST_FORM_SUBMISSION_THROTTLE_H_

Powered by Google App Engine
This is Rietveld 408576698