OLD | NEW |
1 /* | 1 /* |
2 * Copyright (C) 2011 Google, Inc. All rights reserved. | 2 * Copyright (C) 2011 Google, Inc. All rights reserved. |
3 * | 3 * |
4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
5 * modification, are permitted provided that the following conditions | 5 * modification, are permitted provided that the following conditions |
6 * are met: | 6 * are met: |
7 * 1. Redistributions of source code must retain the above copyright | 7 * 1. Redistributions of source code must retain the above copyright |
8 * notice, this list of conditions and the following disclaimer. | 8 * notice, this list of conditions and the following disclaimer. |
9 * 2. Redistributions in binary form must reproduce the above copyright | 9 * 2. Redistributions in binary form must reproduce the above copyright |
10 * notice, this list of conditions and the following disclaimer in the | 10 * notice, this list of conditions and the following disclaimer in the |
(...skipping 10 matching lines...) Expand all Loading... |
21 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | 21 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE | 22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
23 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | 23 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
24 */ | 24 */ |
25 | 25 |
26 #ifndef ContentSecurityPolicy_h | 26 #ifndef ContentSecurityPolicy_h |
27 #define ContentSecurityPolicy_h | 27 #define ContentSecurityPolicy_h |
28 | 28 |
29 #include "bindings/v8/ScriptState.h" | 29 #include "bindings/v8/ScriptState.h" |
30 #include "core/dom/Document.h" | 30 #include "core/dom/Document.h" |
| 31 #include "core/dom/ExecutionContext.h" |
31 #include "platform/network/ContentSecurityPolicyParsers.h" | 32 #include "platform/network/ContentSecurityPolicyParsers.h" |
32 #include "platform/network/HTTPParsers.h" | 33 #include "platform/network/HTTPParsers.h" |
33 #include "platform/weborigin/ReferrerPolicy.h" | 34 #include "platform/weborigin/ReferrerPolicy.h" |
34 #include "wtf/HashSet.h" | 35 #include "wtf/HashSet.h" |
35 #include "wtf/PassOwnPtr.h" | 36 #include "wtf/PassOwnPtr.h" |
36 #include "wtf/PassRefPtr.h" | 37 #include "wtf/PassRefPtr.h" |
37 #include "wtf/RefCounted.h" | 38 #include "wtf/RefCounted.h" |
38 #include "wtf/Vector.h" | 39 #include "wtf/Vector.h" |
39 #include "wtf/text/StringHash.h" | 40 #include "wtf/text/StringHash.h" |
40 #include "wtf/text/TextPosition.h" | 41 #include "wtf/text/TextPosition.h" |
41 #include "wtf/text/WTFString.h" | 42 #include "wtf/text/WTFString.h" |
42 | 43 |
43 namespace WTF { | 44 namespace WTF { |
44 class OrdinalNumber; | 45 class OrdinalNumber; |
45 } | 46 } |
46 | 47 |
47 namespace WebCore { | 48 namespace WebCore { |
48 | 49 |
49 class ContentSecurityPolicyResponseHeaders; | 50 class ContentSecurityPolicyResponseHeaders; |
50 class CSPDirectiveList; | 51 class CSPDirectiveList; |
51 class DOMStringList; | 52 class DOMStringList; |
52 class JSONObject; | 53 class JSONObject; |
53 class KURL; | 54 class KURL; |
54 class ExecutionContextClient; | |
55 class SecurityOrigin; | 55 class SecurityOrigin; |
56 | 56 |
57 typedef int SandboxFlags; | 57 typedef int SandboxFlags; |
58 typedef Vector<OwnPtr<CSPDirectiveList> > CSPDirectiveListVector; | 58 typedef Vector<OwnPtr<CSPDirectiveList> > CSPDirectiveListVector; |
59 | 59 |
60 class ContentSecurityPolicy : public RefCounted<ContentSecurityPolicy> { | 60 class ContentSecurityPolicy : public RefCounted<ContentSecurityPolicy> { |
61 WTF_MAKE_FAST_ALLOCATED; | 61 WTF_MAKE_FAST_ALLOCATED; |
62 public: | 62 public: |
63 // CSP 1.0 Directives | 63 // CSP 1.0 Directives |
64 static const char ConnectSrc[]; | 64 static const char ConnectSrc[]; |
(...skipping 10 matching lines...) Expand all Loading... |
75 | 75 |
76 // CSP 1.1 Directives | 76 // CSP 1.1 Directives |
77 static const char BaseURI[]; | 77 static const char BaseURI[]; |
78 static const char ChildSrc[]; | 78 static const char ChildSrc[]; |
79 static const char FormAction[]; | 79 static const char FormAction[]; |
80 static const char FrameAncestors[]; | 80 static const char FrameAncestors[]; |
81 static const char PluginTypes[]; | 81 static const char PluginTypes[]; |
82 static const char ReflectedXSS[]; | 82 static const char ReflectedXSS[]; |
83 static const char Referrer[]; | 83 static const char Referrer[]; |
84 | 84 |
85 static PassRefPtr<ContentSecurityPolicy> create(ExecutionContextClient* clie
nt) | 85 static PassRefPtr<ContentSecurityPolicy> create(ExecutionContext* executionC
ontext) |
86 { | 86 { |
87 return adoptRef(new ContentSecurityPolicy(client)); | 87 return adoptRef(new ContentSecurityPolicy(executionContext)); |
88 } | 88 } |
89 ~ContentSecurityPolicy(); | 89 ~ContentSecurityPolicy(); |
90 | 90 |
91 void copyStateFrom(const ContentSecurityPolicy*); | 91 void copyStateFrom(const ContentSecurityPolicy*); |
92 | 92 |
93 enum ReportingStatus { | 93 enum ReportingStatus { |
94 SendReport, | 94 SendReport, |
95 SuppressReport | 95 SuppressReport |
96 }; | 96 }; |
97 | 97 |
(...skipping 68 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
166 SecurityOrigin* securityOrigin() const; | 166 SecurityOrigin* securityOrigin() const; |
167 void enforceSandboxFlags(SandboxFlags) const; | 167 void enforceSandboxFlags(SandboxFlags) const; |
168 String evalDisabledErrorMessage() const; | 168 String evalDisabledErrorMessage() const; |
169 | 169 |
170 bool experimentalFeaturesEnabled() const; | 170 bool experimentalFeaturesEnabled() const; |
171 | 171 |
172 static bool shouldBypassMainWorld(ExecutionContext*); | 172 static bool shouldBypassMainWorld(ExecutionContext*); |
173 | 173 |
174 static bool isDirectiveName(const String&); | 174 static bool isDirectiveName(const String&); |
175 | 175 |
176 ExecutionContextClient* client() const { return m_client; } | 176 ExecutionContext* executionContext() const { return m_executionContext; } |
177 Document* document() const { return client()->isDocument() ? toDocument(clie
nt()) : 0; } | 177 Document* document() const { return m_executionContext->isDocument() ? toDoc
ument(m_executionContext) : 0; } |
178 | 178 |
179 private: | 179 private: |
180 explicit ContentSecurityPolicy(ExecutionContextClient*); | 180 explicit ContentSecurityPolicy(ExecutionContext*); |
181 | 181 |
182 void logToConsole(const String& message) const; | 182 void logToConsole(const String& message) const; |
183 void addPolicyFromHeaderValue(const String&, ContentSecurityPolicyHeaderType
, ContentSecurityPolicyHeaderSource); | 183 void addPolicyFromHeaderValue(const String&, ContentSecurityPolicyHeaderType
, ContentSecurityPolicyHeaderSource); |
184 | 184 |
185 bool shouldSendViolationReport(const String&) const; | 185 bool shouldSendViolationReport(const String&) const; |
186 void didSendViolationReport(const String&); | 186 void didSendViolationReport(const String&); |
187 | 187 |
188 ExecutionContextClient* m_client; | 188 ExecutionContext* m_executionContext; |
189 bool m_overrideInlineStyleAllowed; | 189 bool m_overrideInlineStyleAllowed; |
190 CSPDirectiveListVector m_policies; | 190 CSPDirectiveListVector m_policies; |
191 | 191 |
192 HashSet<unsigned, AlreadyHashed> m_violationReportsSent; | 192 HashSet<unsigned, AlreadyHashed> m_violationReportsSent; |
193 | 193 |
194 // We put the hash functions used on the policy object so that we only need | 194 // We put the hash functions used on the policy object so that we only need |
195 // to calculate a hash once and then distribute it to all of the directives | 195 // to calculate a hash once and then distribute it to all of the directives |
196 // for validation. | 196 // for validation. |
197 uint8_t m_scriptHashAlgorithmsUsed; | 197 uint8_t m_scriptHashAlgorithmsUsed; |
198 uint8_t m_styleHashAlgorithmsUsed; | 198 uint8_t m_styleHashAlgorithmsUsed; |
199 }; | 199 }; |
200 | 200 |
201 } | 201 } |
202 | 202 |
203 #endif | 203 #endif |
OLD | NEW |