CSP Suborigins

Source/core/page/ContentSecurityPolicy.h

 /*
  * Copyright (C) 2011 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 32 matching lines @@
 
 class ContentSecurityPolicyResponseHeaders;
 class CSPDirectiveList;
 class DOMStringList;
 class JSONObject;
 class KURL;
 class ScriptExecutionContext;
 class SecurityOrigin;
 
 typedef int SandboxFlags;
+typedef String SuboriginFlags;
 typedef Vector<OwnPtr<CSPDirectiveList> > CSPDirectiveListVector;
 
 class ContentSecurityPolicy {
     WTF_MAKE_FAST_ALLOCATED;
 public:
     static PassOwnPtr<ContentSecurityPolicy> create(ScriptExecutionContext* scriptExecutionContext)
     {
         return adoptPtr(new ContentSecurityPolicy(scriptExecutionContext));
     }
     ~ContentSecurityPolicy();
@@ skipping 47 matching lines @@
     bool isActive() const;
     void gatherReportURIs(DOMStringList&) const;
 
     void reportDirectiveAsSourceExpression(const String& directiveName, const String& sourceExpression) const;
     void reportDuplicateDirective(const String&) const;
     void reportInvalidDirectiveValueCharacter(const String& directiveName, const String& value) const;
     void reportInvalidPathCharacter(const String& directiveName, const String& value, const char) const;
     void reportInvalidNonce(const String&) const;
     void reportInvalidPluginTypes(const String&) const;
     void reportInvalidSandboxFlags(const String&) const;
+    void reportInvalidSuboriginFlags(const String&) const;
     void reportInvalidSourceExpression(const String& directiveName, const String& source) const;
     void reportInvalidReflectedXSS(const String&) const;
     void reportMissingReportURI(const String&) const;
     void reportUnsupportedDirective(const String&) const;
     void reportViolation(const String& directiveText, const String& effectiveDirective, const String& consoleMessage, const KURL& blockedURL, const Vector<KURL>& reportURIs, const String& header);
 
     void reportBlockedScriptExecutionToInspector(const String& directiveText) const;
 
     const KURL& url() const;
     KURL completeURL(const String&) const;
     SecurityOrigin* securityOrigin() const;
     void enforceSandboxFlags(SandboxFlags) const;
+    void enforceSuboriginFlags(SuboriginFlags) const;
     String evalDisabledErrorMessage() const;
 
     bool experimentalFeaturesEnabled() const;
 
     static bool shouldBypassMainWorld(ScriptExecutionContext*);
 
     ScriptExecutionContext* scriptExecutionContext() { return m_scriptExecutionContext; }
 
 private:
     explicit ContentSecurityPolicy(ScriptExecutionContext*);
 
     void logToConsole(const String& message) const;
     void addPolicyFromHeaderValue(const String&, HeaderType);
 
     bool shouldSendViolationReport(const String&) const;
     void didSendViolationReport(const String&);
 
     ScriptExecutionContext* m_scriptExecutionContext;
     bool m_overrideInlineStyleAllowed;
     CSPDirectiveListVector m_policies;
 
     HashSet<unsigned, AlreadyHashed> m_violationReportsSent;
 };
 
 }
 
 #endif