Moved all tests about bypassing CSP into csp-tests (content layer)

content/common/content_security_policy/content_security_policy.cc

 // Copyright 2017 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <sstream>
 #include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
 #include "content/common/content_security_policy/csp_context.h"
 
 namespace content {
@@ skipping 76 matching lines @@
                     const GURL& url,
                     bool is_redirect,
                     const SourceLocation& source_location) {
   if (CSPSourceList::Allow(directive.source_list, url, context, is_redirect))
     return true;
 
   ReportViolation(context, policy, directive, directive_name, url, is_redirect,
                   source_location);
   return false;
 }
+const GURL ExtractInnerURL(const GURL& url) {

[arthursonzogni, 2017/04/04 11:54:34]

Nit: Add a newline above.

[andypaicu, 2017/04/04 15:10:07]

Done

+  if (const GURL* inner_url = url.inner_url())
+    return *inner_url;
+  else
+    // TODO(arthursonzogni): revisit this once GURL::inner_url support blob-URL.
+    return GURL(url.path());
+}
+
+bool ShouldBypassContentSecurityPolicy(CSPContext* context, const GURL& url) {
+  if (url.SchemeIsFileSystem() || url.SchemeIsBlob()) {
+    return context->SchemeShouldBypassCSP(ExtractInnerURL(url).scheme());
+  } else {
+    return context->SchemeShouldBypassCSP(url.scheme());
+  }
+}
 
 }  // namespace
 
 ContentSecurityPolicy::ContentSecurityPolicy()
     : header(std::string(),
              blink::WebContentSecurityPolicyTypeEnforce,
              blink::WebContentSecurityPolicySourceHTTP) {}
 
 ContentSecurityPolicy::ContentSecurityPolicy(
     const ContentSecurityPolicyHeader& header,
     const std::vector<CSPDirective>& directives,
     const std::vector<std::string>& report_endpoints)
     : header(header),
       directives(directives),
       report_endpoints(report_endpoints) {}
 
 ContentSecurityPolicy::ContentSecurityPolicy(const ContentSecurityPolicy&) =
     default;
 ContentSecurityPolicy::~ContentSecurityPolicy() = default;
 
 // static
 bool ContentSecurityPolicy::Allow(const ContentSecurityPolicy& policy,
                                   CSPDirective::Name directive_name,
                                   const GURL& url,
                                   bool is_redirect,
                                   CSPContext* context,
                                   const SourceLocation& source_location) {
+  if (ShouldBypassContentSecurityPolicy(context, url))
+    return true;
+
   CSPDirective::Name current_directive_name = directive_name;
   do {
     for (const CSPDirective& directive : policy.directives) {
       if (directive.name == current_directive_name) {
         bool allowed =
             AllowDirective(context, policy, directive, directive_name, url,
                            is_redirect, source_location);
         return allowed ||
                policy.header.type == blink::WebContentSecurityPolicyTypeReport;
       }
@@ skipping 19 matching lines @@
     is_first_policy = false;
     text << "report-uri";
     for (const std::string& endpoint : report_endpoints)
       text << " " << endpoint;
   }
 
   return text.str();
 }
 
 }  // namespace content