Introduce WebSecurityPolicy for security related methods

Introduce WebSecurityPolicy for security related methods.

Move security related methods out of WebKit.h into its own class WebSecurityPolicy. This involves these functions:
 - registerURLSchemeAsLocal
 - registerURLSchemeAsNoAccess
 - whiteListAccessFromOrigin
 - resetOriginAccessWhiteLists

BUG=24601
TEST=Compiled locally, try bot'ed.

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=29639

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=29758

[Mohamed Mansour, 2009-10-20 04:35:24]

This time I didn't forget webkit.gyp

[darin (slow to review), 2009-10-20 05:48:29]

Thanks for working on this!!

http://codereview.chromium.org/293021/diff/6/1008
File webkit/api/public/WebSecurityPolicy.h (right):

http://codereview.chromium.org/293021/diff/6/1008#newcode35
Line 35: #include "WebURL.h"
nit: it looks like you should just be able to forward declare WebURL as you did
for WebString.

http://codereview.chromium.org/293021/diff/6/1008#newcode39
Line 39: 
please place these methods inside a class named WebSecurityPolicy.  the methods
should be static, and WebSecurityPolicy should have a private constructor to
indicate that it cannot be instantiated.

i meant to do the same for WebScriptController.h.  sorry for not catching this
before!

http://codereview.chromium.org/293021/diff/6/1010
File webkit/api/src/WebSecurityPolicy.cpp (right):

http://codereview.chromium.org/293021/diff/6/1010#newcode38
Line 38: 
nit: add a 'using namespace WebCore' so you don't have to mention WebCore:: down
below.

[Hironori Bono, 2009-10-21 02:58:51]

This is just a drive-by nit.

Regards,

Hironori Bono

http://codereview.chromium.org/293021/diff/4001/4009
File webkit/tools/test_shell/test_shell_webkit_init.h (right):

http://codereview.chromium.org/293021/diff/4001/4009#newcode53
Line 53: WebKit::WebSecurityPolicy::enableV8SingleThreadMode();
nit: As far as I read the "WebSecurityPolicy.h", this enableV8SingleMode() is
not a member of the WebSecurityPolicy class, and I'm wondering if we need this
scope here.

[Mohamed Mansour, 2009-10-21 03:47:17]

Thanks hbono. I did a stupid mistake (handling two different bugs in the same
time).

Darin, I did what you suggested, you can re-review before I commit :)

http://codereview.chromium.org/293021/diff/6/1008
File webkit/api/public/WebSecurityPolicy.h (right):

http://codereview.chromium.org/293021/diff/6/1008#newcode35
Line 35: #include "WebURL.h"
On 2009/10/20 05:48:29, darin wrote:
> nit: it looks like you should just be able to forward declare WebURL as you
did
> for WebString.

Done. But I have to include it in the .cpp file. If I don't it, it asks for a
KURL parameter error.

http://codereview.chromium.org/293021/diff/6/1008#newcode39
Line 39: 
On 2009/10/20 05:48:29, darin wrote:
> please place these methods inside a class named WebSecurityPolicy.  the
methods
> should be static, and WebSecurityPolicy should have a private constructor to
> indicate that it cannot be instantiated.
> 
> i meant to do the same for WebScriptController.h.  sorry for not catching this
> before!

Done.

http://codereview.chromium.org/293021/diff/6/1010
File webkit/api/src/WebSecurityPolicy.cpp (right):

http://codereview.chromium.org/293021/diff/6/1010#newcode38
Line 38: 
On 2009/10/20 05:48:29, darin wrote:
> nit: add a 'using namespace WebCore' so you don't have to mention WebCore::
down
> below.

Done.

[darin (slow to review), 2009-10-21 04:02:11]

http://codereview.chromium.org/293021/diff/6/1008
File webkit/api/public/WebSecurityPolicy.h (right):

http://codereview.chromium.org/293021/diff/6/1008#newcode35
Line 35: #include "WebURL.h"
On 2009/10/21 03:47:17, Mohamed Mansour wrote:
> On 2009/10/20 05:48:29, darin wrote:
> > nit: it looks like you should just be able to forward declare WebURL as you
> did
> > for WebString.
> 
> Done. But I have to include it in the .cpp file. If I don't it, it asks for a
> KURL parameter error.

That's ok.  It is a good thing to have the most minimal includes in header
files, and then put those that are actually needed in .cpp files.  This way the
cost of including a header is minimized.  For example, if a .cpp file doesn't
use WebURL, then it doesn't need WebURL.h.

http://codereview.chromium.org/293021/diff/4001/4009
File webkit/tools/test_shell/test_shell_webkit_init.h (right):

http://codereview.chromium.org/293021/diff/4001/4009#newcode53
Line 53: WebKit::WebSecurityPolicy::enableV8SingleThreadMode();
On 2009/10/21 02:58:53, hbono wrote:
> nit: As far as I read the "WebSecurityPolicy.h", this enableV8SingleMode() is
> not a member of the WebSecurityPolicy class, and I'm wondering if we need this
> scope here.

Yes, I agree.  Only the first two methods have to do with security policy.

[darin (slow to review), 2009-10-21 04:04:49]

just nits:

http://codereview.chromium.org/293021/diff/7001/7002
File chrome/renderer/extensions/extension_process_bindings.cc (right):

http://codereview.chromium.org/293021/diff/7001/7002#newcode40
Line 40: using WebKit::WebFrame;
please insert 'using WebKit::WebSecurityPolicy' and drop the WebKit:: prefixes
down below.

http://codereview.chromium.org/293021/diff/7001/7003
File chrome/renderer/render_thread.cc (right):

http://codereview.chromium.org/293021/diff/7001/7003#newcode71
Line 71: using WebKit::WebFontCache;
please insert 'using WebKit::WebSecurityPolicy' here and then drop the WebKit::
prefixes down below.

http://codereview.chromium.org/293021/diff/7001/7005
File webkit/api/public/WebSecurityPolicy.h (right):

http://codereview.chromium.org/293021/diff/7001/7005#newcode45
Line 45: static void registerURLSchemeAsLocal(const WebString&);
please put WEBKIT_API in front of these static keywords.  that way the functions
will be exported when we get around to building webkit.dll!

http://codereview.chromium.org/293021/diff/7001/7008
File webkit/tools/test_shell/layout_test_controller.cc (right):

http://codereview.chromium.org/293021/diff/7001/7008#newcode35
Line 35: using WebKit::WebScriptSource;
please insert a 'using WebKit::WebSecurityPolicy'.  then you can drop the
WebKit:: prefixes down below.

[Mohamed Mansour, 2009-10-21 05:03:01]

Updated the nits, sorry for the trouble.

http://codereview.chromium.org/293021/diff/7001/7002
File chrome/renderer/extensions/extension_process_bindings.cc (right):

http://codereview.chromium.org/293021/diff/7001/7002#newcode40
Line 40: using WebKit::WebFrame;
On 2009/10/21 04:04:49, darin wrote:
> please insert 'using WebKit::WebSecurityPolicy' and drop the WebKit:: prefixes
> down below.

Done.

http://codereview.chromium.org/293021/diff/7001/7003
File chrome/renderer/render_thread.cc (right):

http://codereview.chromium.org/293021/diff/7001/7003#newcode71
Line 71: using WebKit::WebFontCache;
On 2009/10/21 04:04:49, darin wrote:
> please insert 'using WebKit::WebSecurityPolicy' here and then drop the
WebKit::
> prefixes down below.

Done.

http://codereview.chromium.org/293021/diff/7001/7005
File webkit/api/public/WebSecurityPolicy.h (right):

http://codereview.chromium.org/293021/diff/7001/7005#newcode45
Line 45: static void registerURLSchemeAsLocal(const WebString&);
On 2009/10/21 04:04:49, darin wrote:
> please put WEBKIT_API in front of these static keywords.  that way the
functions
> will be exported when we get around to building webkit.dll!

Done.

http://codereview.chromium.org/293021/diff/7001/7008
File webkit/tools/test_shell/layout_test_controller.cc (right):

http://codereview.chromium.org/293021/diff/7001/7008#newcode35
Line 35: using WebKit::WebScriptSource;
On 2009/10/21 04:04:49, darin wrote:
> please insert a 'using WebKit::WebSecurityPolicy'.  then you can drop the
> WebKit:: prefixes down below.

Done.

[darin (slow to review), 2009-10-21 05:18:34]

LGTM

http://codereview.chromium.org/293021/diff/7011/10004
File webkit/api/public/WebSecurityPolicy.h (right):

http://codereview.chromium.org/293021/diff/7011/10004#newcode50
Line 50: WEBKIT_API  static void registerURLSchemeAsNoAccess(const WebString&);
nit: there's an extra space after WEBKIT_API