CSP Suborigins

Source/core/frame/csp/ContentSecurityPolicy.h

 /*
  * Copyright (C) 2011 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 70 matching lines @@
     static const char FormAction[];
     static const char FrameAncestors[];
     static const char PluginTypes[];
     static const char ReflectedXSS[];
     static const char Referrer[];
 
     // Manifest Directives (to be merged into CSP Level 2)
     // https://w3c.github.io/manifest/#content-security-policy
     static const char ManifestSrc[];
 
+    // Experimental Directives (post CSP 1.1)
+    static const char Suborigin[];
+
     enum ReportingStatus {
         SendReport,
         SuppressReport
     };
 
     static PassRefPtr<ContentSecurityPolicy> create()
     {
         return adoptRef(new ContentSecurityPolicy());
     }
     ~ContentSecurityPolicy();
@@ skipping 59 matching lines @@
     // If a frame is passed in, the message will be logged to its active document's console.
     // Otherwise, the message will be logged to this object's |m_executionContext|.
     void logToConsole(PassRefPtrWillBeRawPtr<ConsoleMessage>, LocalFrame* = 0);
 
     void reportDirectiveAsSourceExpression(const String& directiveName, const String& sourceExpression);
     void reportDuplicateDirective(const String&);
     void reportInvalidDirectiveValueCharacter(const String& directiveName, const String& value);
     void reportInvalidPathCharacter(const String& directiveName, const String& value, const char);
     void reportInvalidPluginTypes(const String&);
     void reportInvalidSandboxFlags(const String&);
+    void reportInvalidSuboriginFlags(const String&);
     void reportInvalidSourceExpression(const String& directiveName, const String& source);
     void reportInvalidReflectedXSS(const String&);
     void reportMissingReportURI(const String&);
     void reportUnsupportedDirective(const String&);
     void reportInvalidInReportOnly(const String&);
     void reportInvalidReferrer(const String&);
     void reportReportOnlyInMeta(const String&);
     void reportMetaOutsideHead(const String&);
 
     // If a frame is passed in, the report will be sent using it as a context. If no frame is
     // passed in, the report will be sent via this object's |m_executionContext| (or dropped
     // on the floor if no such context is available).
     void reportViolation(const String& directiveText, const String& effectiveDirective, const String& consoleMessage, const KURL& blockedURL, const Vector<String>& reportEndpoints, const String& header, LocalFrame* = 0);
 
     void reportBlockedScriptExecutionToInspector(const String& directiveText) const;
 
     const KURL url() const;
     void enforceSandboxFlags(SandboxFlags);
+    void enforceSuborigin(const String&);
     String evalDisabledErrorMessage() const;
 
     bool urlMatchesSelf(const KURL&) const;
     bool protocolMatchesSelf(const KURL&) const;
 
     bool experimentalFeaturesEnabled() const;
 
     static bool shouldBypassMainWorld(ExecutionContext*);
 
     static bool isDirectiveName(const String&);
@@ skipping 21 matching lines @@
     HashSet<unsigned, AlreadyHashed> m_violationReportsSent;
 
     // We put the hash functions used on the policy object so that we only need
     // to calculate a hash once and then distribute it to all of the directives
     // for validation.
     uint8_t m_scriptHashAlgorithmsUsed;
     uint8_t m_styleHashAlgorithmsUsed;
 
     // State flags used to configure the environment after parsing a policy.
     SandboxFlags m_sandboxMask;
+    String m_suboriginName;
     ReferrerPolicy m_referrerPolicy;
     String m_disableEvalErrorMessage;
 
     OwnPtr<CSPSource> m_selfSource;
     String m_selfProtocol;
 };
 
 }
 
 #endif