Added validation of the policy specified in the 'csp' attribute

third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp

Index: third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp
diff --git a/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp b/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp
index 772b48e6dbface86415d6e636a7f3efa6acd07db..e46f5e9eca75501c9ca1cfa29d77b3c8af13a1db 100644
--- a/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp
+++ b/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp
@@ -967,6 +967,38 @@ void CSPDirectiveList::Parse(const UChar* begin, const UChar* end) {
   }
 }
 
+// static
+bool CSPDirectiveList::IsValid(
+    const String& directive_list,
+    ContentSecurityPolicyHeaderType header_type,
+    ContentSecurityPolicyHeaderSource header_source) {
+  Vector<UChar> characters;
+  directive_list.AppendTo(characters);
+  const UChar* begin = characters.data();
+  const UChar* end = begin + characters.size();
+
+  return IsValid(begin, end, header_type, header_source);
+}
+
+// static
+bool CSPDirectiveList::IsValid(
+    const UChar* begin,
+    const UChar* end,
+    ContentSecurityPolicyHeaderType header_type,
+    ContentSecurityPolicyHeaderSource header_source) {
+  if (begin == end)
+    return false;
+
+  ContentSecurityPolicy* policy = ContentSecurityPolicy::Create(
+      SecurityViolationReportingPolicy::kSuppressReporting);
+
+  CSPDirectiveList::Create(policy, begin, end, header_type, header_source);

[Mike West, 2017/05/29 07:46:21]

I think this will accept something like `script-src 'none', object-src 'none'`
(which is multiple policies due to the `,`). Can you add a check somewhere for
this case, which shouldn't be accepted as a `csp` attribute?

+
+  bool is_valid = policy->IsValid();
+
+  return is_valid;
+}
+
 // directive         = *WSP [ directive-name [ WSP directive-value ] ]
 // directive-name    = 1*( ALPHA / DIGIT / "-" )
 // directive-value   = *( WSP / <VCHAR except ";"> )
@@ -1225,9 +1257,7 @@ void CSPDirectiveList::AddDirective(const String& name, const String& value) {
     policy_->UsesScriptHashAlgorithms(script_src_->HashAlgorithmsUsed());
   } else if (type == ContentSecurityPolicy::DirectiveType::kObjectSrc) {
     SetCSPDirective<SourceListDirective>(name, value, object_src_);
-  } else if (type ==
-
-             ContentSecurityPolicy::DirectiveType::kFrameAncestors) {
+  } else if (type == ContentSecurityPolicy::DirectiveType::kFrameAncestors) {
     SetCSPDirective<SourceListDirective>(name, value, frame_ancestors_);
   } else if (type == ContentSecurityPolicy::DirectiveType::kFrameSrc) {
     SetCSPDirective<SourceListDirective>(name, value, frame_src_);