Added validation of the policy specified in the 'csp' attribute

third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CSPDirectiveList_h
 #define CSPDirectiveList_h
 
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "core/frame/csp/MediaListDirective.h"
 #include "core/frame/csp/SourceListDirective.h"
@@ skipping 21 matching lines @@
 
  public:
   static CSPDirectiveList* Create(ContentSecurityPolicy*,
                                   const UChar* begin,
                                   const UChar* end,
                                   ContentSecurityPolicyHeaderType,
                                   ContentSecurityPolicyHeaderSource);
 
   void Parse(const UChar* begin, const UChar* end);
 
+  static bool IsValid(const UChar* begin, const UChar* end);
+  static bool IsValid(const String& directive_list);
+
   const String& Header() const { return header_; }
   ContentSecurityPolicyHeaderType HeaderType() const { return header_type_; }
   ContentSecurityPolicyHeaderSource HeaderSource() const {
     return header_source_;
   }
 
   bool AllowJavaScriptURLs(Element*,
                            const String& source,
                            const String& context_url,
                            const WTF::OrdinalNumber& context_line,
@@ skipping 133 matching lines @@
   FRIEND_TEST_ALL_PREFIXES(CSPDirectiveListTest, IsMatchingNoncePresent);
   FRIEND_TEST_ALL_PREFIXES(CSPDirectiveListTest, GetSourceVector);
   FRIEND_TEST_ALL_PREFIXES(CSPDirectiveListTest, OperativeDirectiveGivenType);
 
   enum RequireSRIForToken { kNone = 0, kScript = 1 << 0, kStyle = 1 << 1 };
 
   CSPDirectiveList(ContentSecurityPolicy*,
                    ContentSecurityPolicyHeaderType,
                    ContentSecurityPolicyHeaderSource);
 
-  bool ParseDirective(const UChar* begin,
-                      const UChar* end,
-                      String& name,
-                      String& value);
+  static bool ParseDirective(const UChar* begin,
+                             const UChar* end,
+                             String& name,
+                             String& value,
+                             ContentSecurityPolicy*);
   void ParseRequireSRIFor(const String& name, const String& value);
   void ParseReportURI(const String& name, const String& value);
   void ParsePluginTypes(const String& name, const String& value);
   void AddDirective(const String& name, const String& value);
   void ApplySandboxPolicy(const String& name, const String& sandbox_policy);
   void EnforceStrictMixedContentChecking(const String& name,
                                          const String& value);
   void EnableInsecureRequestsUpgrade(const String& name, const String& value);
   void TreatAsPublicAddress(const String& name, const String& value);
 
@@ skipping 129 matching lines @@
   uint8_t require_sri_for_;
 
   Vector<String> report_endpoints_;
 
   String eval_disabled_error_message_;
 };
 
 }  // namespace blink
 
 #endif