CSP Suborigins

Source/core/dom/ExecutionContext.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  * Copyright (C) 2012 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 19 matching lines @@
 
 #include "core/dom/ExecutionContextTask.h"
 #include "core/events/ErrorEvent.h"
 #include "core/events/EventTarget.h"
 #include "core/html/PublicURLManager.h"
 #include "core/inspector/InspectorInstrumentation.h"
 #include "core/inspector/ScriptCallStack.h"
 #include "core/page/WindowFocusAllowedIndicator.h"
 #include "core/workers/WorkerGlobalScope.h"
 #include "core/workers/WorkerThread.h"
+#include "platform/RuntimeEnabledFeatures.h"
 #include "wtf/MainThread.h"
 
 namespace blink {
 
 class ExecutionContext::PendingException : public NoBaseWillBeGarbageCollectedFinalized<ExecutionContext::PendingException> {
     WTF_MAKE_NONCOPYABLE(PendingException);
 public:
     PendingException(const String& errorMessage, int lineNumber, int columnNumber, int scriptId, const String& sourceURL, PassRefPtrWillBeRawPtr<ScriptCallStack> callStack)
         : m_errorMessage(errorMessage)
         , m_lineNumber(lineNumber)
@@ skipping 169 matching lines @@
 }
 
 bool ExecutionContext::isWindowInteractionAllowed() const
 {
     // FIXME: WindowFocusAllowedIndicator::windowFocusAllowed() is temporary,
     // it will be removed as soon as WebScopedWindowFocusAllowedIndicator will
     // be updated to not use WindowFocusAllowedIndicator.
     return m_windowInteractionTokens > 0 || WindowFocusAllowedIndicator::windowFocusAllowed();
 }
 
+// |name| should be non-empty, and this should be enforced by parsing.
+void ExecutionContext::enforceSuborigin(const String& name)
+{
+    if (name.isNull())
+        return;
+    ASSERT(!name.isEmpty());
+    ASSERT(RuntimeEnabledFeatures::suboriginsEnabled());
+    SecurityOrigin* origin = securityContext().securityOrigin();
+    ASSERT(origin);
+    ASSERT(!origin->hasSuborigin() || origin->suboriginName() == name);

[Mike West, 2015/03/23 07:32:55]

ASSERTing here means that `Content-Security-Policy: suborigin foo, suborigin
bar` will crash the renderer, doesn't it?

[jww, 2015/04/11 02:52:36]

It should never get to that point. In the assignment of suborigins, the last
assigned suborigin should "win" and be the assigned suborigin. If this state is
ever reached in enforce, something very bad has happened, hence the ASSERT. I've
added a test for multiple suborigins to verify that there isn't a renderer
crash.

+    origin->addSuborigin(name);
+    securityContext().didUpdateSecurityOrigin();
+}
+
 DEFINE_TRACE(ExecutionContext)
 {
 #if ENABLE(OILPAN)
     visitor->trace(m_pendingExceptions);
     visitor->trace(m_publicURLManager);
     HeapSupplementable<ExecutionContext>::trace(visitor);
 #endif
     ContextLifecycleNotifier::trace(visitor);
 }
 
 } // namespace blink