CSP Suborigins

Source/core/frame/csp/CSPDirectiveList.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CSPDirectiveList_h
 #define CSPDirectiveList_h
 
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "core/frame/csp/MediaListDirective.h"
 #include "core/frame/csp/SourceListDirective.h"
@@ skipping 56 matching lines @@
 private:
     CSPDirectiveList(ContentSecurityPolicy*, ContentSecurityPolicyHeaderType, ContentSecurityPolicyHeaderSource);
 
     bool parseDirective(const UChar* begin, const UChar* end, String& name, String& value);
     void parseReportURI(const String& name, const String& value);
     void parsePluginTypes(const String& name, const String& value);
     void parseReflectedXSS(const String& name, const String& value);
     void parseReferrer(const String& name, const String& value);
     void addDirective(const String& name, const String& value);
     void applySandboxPolicy(const String& name, const String& sandboxPolicy);
+    void applySuboriginPolicy(const String& name, const String& suboriginPolicy);
+    String parseSuboriginName(const String& policy);

[Mike West, 2014/10/23 12:59:19]

Nit: Move this up next to the other parse functions.

[jww, 2015/03/20 22:50:03]

Done.

 
     template <class CSPDirectiveType>
     void setCSPDirective(const String& name, const String& value, OwnPtr<CSPDirectiveType>&);
 
     SourceListDirective* operativeDirective(SourceListDirective*) const;
     SourceListDirective* operativeDirective(SourceListDirective*, SourceListDirective* override) const;
     void reportViolation(const String& directiveText, const String& effectiveDirective, const String& consoleMessage, const KURL& blockedURL) const;
     void reportViolationWithFrame(const String& directiveText, const String& effectiveDirective, const String& consoleMessage, const KURL& blockedURL, LocalFrame*) const;
     void reportViolationWithLocation(const String& directiveText, const String& effectiveDirective, const String& consoleMessage, const KURL& blockedURL, const String& contextURL, const WTF::OrdinalNumber& contextLine) const;
     void reportViolationWithState(const String& directiveText, const String& effectiveDirective, const String& message, const KURL& blockedURL, ScriptState*) const;
@@ skipping 18 matching lines @@
     bool denyIfEnforcingPolicy() const { return m_reportOnly; }
 
     ContentSecurityPolicy* m_policy;
 
     String m_header;
     ContentSecurityPolicyHeaderType m_headerType;
     ContentSecurityPolicyHeaderSource m_headerSource;
 
     bool m_reportOnly;
     bool m_haveSandboxPolicy;
+    bool m_haveSuboriginPolicy;

[Mike West, 2014/10/23 12:59:19]

Nit: These both should be "hasXXX", not "haveXXX". Sorry about that. Would you
mind cleaning up the existing usage in a separate CL? Or I'll do it if you don't
have time.

[jww, 2015/03/20 22:50:03]

Done.

     ReflectedXSSDisposition m_reflectedXSSDisposition;
 
     bool m_didSetReferrerPolicy;
     ReferrerPolicy m_referrerPolicy;
 
     OwnPtr<MediaListDirective> m_pluginTypes;
     OwnPtr<SourceListDirective> m_baseURI;
     OwnPtr<SourceListDirective> m_childSrc;
     OwnPtr<SourceListDirective> m_connectSrc;
     OwnPtr<SourceListDirective> m_defaultSrc;
@@ skipping 10 matching lines @@
 
     Vector<String> m_reportEndpoints;
 
     String m_evalDisabledErrorMessage;
 };
 
 
 } // namespace
 
 #endif