Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 /* | 1 /* |
| 2 * Copyright (C) 2011 Google, Inc. All rights reserved. | 2 * Copyright (C) 2011 Google, Inc. All rights reserved. |
| 3 * | 3 * |
| 4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
| 5 * modification, are permitted provided that the following conditions | 5 * modification, are permitted provided that the following conditions |
| 6 * are met: | 6 * are met: |
| 7 * 1. Redistributions of source code must retain the above copyright | 7 * 1. Redistributions of source code must retain the above copyright |
| 8 * notice, this list of conditions and the following disclaimer. | 8 * notice, this list of conditions and the following disclaimer. |
| 9 * 2. Redistributions in binary form must reproduce the above copyright | 9 * 2. Redistributions in binary form must reproduce the above copyright |
| 10 * notice, this list of conditions and the following disclaimer in the | 10 * notice, this list of conditions and the following disclaimer in the |
| (...skipping 10 matching lines...) Expand all Loading... | |
| 21 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | 21 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
| 22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE | 22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
| 23 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | 23 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 24 */ | 24 */ |
| 25 | 25 |
| 26 #ifndef ContentSecurityPolicy_h | 26 #ifndef ContentSecurityPolicy_h |
| 27 #define ContentSecurityPolicy_h | 27 #define ContentSecurityPolicy_h |
| 28 | 28 |
| 29 #include "bindings/v8/ScriptState.h" | 29 #include "bindings/v8/ScriptState.h" |
| 30 #include "core/dom/Document.h" | 30 #include "core/dom/Document.h" |
| 31 #include "core/dom/ExecutionContext.h" | |
| 31 #include "platform/network/ContentSecurityPolicyParsers.h" | 32 #include "platform/network/ContentSecurityPolicyParsers.h" |
| 32 #include "platform/network/HTTPParsers.h" | 33 #include "platform/network/HTTPParsers.h" |
| 33 #include "platform/weborigin/ReferrerPolicy.h" | 34 #include "platform/weborigin/ReferrerPolicy.h" |
| 34 #include "wtf/HashSet.h" | 35 #include "wtf/HashSet.h" |
| 35 #include "wtf/PassOwnPtr.h" | 36 #include "wtf/PassOwnPtr.h" |
| 36 #include "wtf/PassRefPtr.h" | 37 #include "wtf/PassRefPtr.h" |
| 37 #include "wtf/RefCounted.h" | 38 #include "wtf/RefCounted.h" |
| 38 #include "wtf/Vector.h" | 39 #include "wtf/Vector.h" |
| 39 #include "wtf/text/StringHash.h" | 40 #include "wtf/text/StringHash.h" |
| 40 #include "wtf/text/TextPosition.h" | 41 #include "wtf/text/TextPosition.h" |
| 41 #include "wtf/text/WTFString.h" | 42 #include "wtf/text/WTFString.h" |
| 42 | 43 |
| 43 namespace WTF { | 44 namespace WTF { |
| 44 class OrdinalNumber; | 45 class OrdinalNumber; |
| 45 } | 46 } |
| 46 | 47 |
| 47 namespace WebCore { | 48 namespace WebCore { |
| 48 | 49 |
| 49 class ContentSecurityPolicyResponseHeaders; | 50 class ContentSecurityPolicyResponseHeaders; |
| 50 class CSPDirectiveList; | 51 class CSPDirectiveList; |
| 51 class DOMStringList; | 52 class DOMStringList; |
| 52 class JSONObject; | 53 class JSONObject; |
| 53 class KURL; | 54 class KURL; |
| 54 class ExecutionContextClient; | |
| 55 class SecurityOrigin; | 55 class SecurityOrigin; |
| 56 | 56 |
| 57 typedef int SandboxFlags; | 57 typedef int SandboxFlags; |
| 58 typedef Vector<OwnPtr<CSPDirectiveList> > CSPDirectiveListVector; | 58 typedef Vector<OwnPtr<CSPDirectiveList> > CSPDirectiveListVector; |
| 59 | 59 |
| 60 class ContentSecurityPolicy : public RefCounted<ContentSecurityPolicy> { | 60 class ContentSecurityPolicy : public RefCounted<ContentSecurityPolicy> { |
| 61 WTF_MAKE_FAST_ALLOCATED; | 61 WTF_MAKE_FAST_ALLOCATED; |
| 62 public: | 62 public: |
| 63 // CSP 1.0 Directives | 63 // CSP 1.0 Directives |
| 64 static const char ConnectSrc[]; | 64 static const char ConnectSrc[]; |
| (...skipping 10 matching lines...) Expand all Loading... | |
| 75 | 75 |
| 76 // CSP 1.1 Directives | 76 // CSP 1.1 Directives |
| 77 static const char BaseURI[]; | 77 static const char BaseURI[]; |
| 78 static const char ChildSrc[]; | 78 static const char ChildSrc[]; |
| 79 static const char FormAction[]; | 79 static const char FormAction[]; |
| 80 static const char FrameAncestors[]; | 80 static const char FrameAncestors[]; |
| 81 static const char PluginTypes[]; | 81 static const char PluginTypes[]; |
| 82 static const char ReflectedXSS[]; | 82 static const char ReflectedXSS[]; |
| 83 static const char Referrer[]; | 83 static const char Referrer[]; |
| 84 | 84 |
| 85 static PassRefPtr<ContentSecurityPolicy> create(ExecutionContextClient* clie nt) | 85 static PassRefPtr<ContentSecurityPolicy> create(ExecutionContext* executionC ontext) |
| 86 { | 86 { |
| 87 return adoptRef(new ContentSecurityPolicy(client)); | 87 return adoptRef(new ContentSecurityPolicy(executionContext)); |
| 88 } | 88 } |
| 89 ~ContentSecurityPolicy(); | 89 ~ContentSecurityPolicy(); |
| 90 | 90 |
| 91 void copyStateFrom(const ContentSecurityPolicy*); | 91 void copyStateFrom(const ContentSecurityPolicy*); |
| 92 | 92 |
| 93 enum ReportingStatus { | 93 enum ReportingStatus { |
| 94 SendReport, | 94 SendReport, |
| 95 SuppressReport | 95 SuppressReport |
| 96 }; | 96 }; |
| 97 | 97 |
| (...skipping 68 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 166 SecurityOrigin* securityOrigin() const; | 166 SecurityOrigin* securityOrigin() const; |
| 167 void enforceSandboxFlags(SandboxFlags) const; | 167 void enforceSandboxFlags(SandboxFlags) const; |
| 168 String evalDisabledErrorMessage() const; | 168 String evalDisabledErrorMessage() const; |
| 169 | 169 |
| 170 bool experimentalFeaturesEnabled() const; | 170 bool experimentalFeaturesEnabled() const; |
| 171 | 171 |
| 172 static bool shouldBypassMainWorld(ExecutionContext*); | 172 static bool shouldBypassMainWorld(ExecutionContext*); |
| 173 | 173 |
| 174 static bool isDirectiveName(const String&); | 174 static bool isDirectiveName(const String&); |
| 175 | 175 |
| 176 ExecutionContextClient* client() const { return m_client; } | 176 ExecutionContext* executionContext() const { return m_executionContext; } |
| 177 Document* document() const { return client()->isDocument() ? toDocument(clie nt()) : 0; } | 177 Document* document() const { return executionContext()->isDocument() ? toDoc ument(executionContext()) : 0; } |
|
tyoshino (SeeGerritForStatus)
2014/06/13 10:46:47
updated to use m_executionContext
| |
| 178 | 178 |
| 179 private: | 179 private: |
| 180 explicit ContentSecurityPolicy(ExecutionContextClient*); | 180 explicit ContentSecurityPolicy(ExecutionContext*); |
| 181 | 181 |
| 182 void logToConsole(const String& message) const; | 182 void logToConsole(const String& message) const; |
| 183 void addPolicyFromHeaderValue(const String&, ContentSecurityPolicyHeaderType , ContentSecurityPolicyHeaderSource); | 183 void addPolicyFromHeaderValue(const String&, ContentSecurityPolicyHeaderType , ContentSecurityPolicyHeaderSource); |
| 184 | 184 |
| 185 bool shouldSendViolationReport(const String&) const; | 185 bool shouldSendViolationReport(const String&) const; |
| 186 void didSendViolationReport(const String&); | 186 void didSendViolationReport(const String&); |
| 187 | 187 |
| 188 ExecutionContextClient* m_client; | 188 ExecutionContext* m_executionContext; |
|
haraken
2014/06/13 09:09:21
Just to confirm: Before this CL, it was guaranteed
tyoshino (SeeGerritForStatus)
2014/06/13 09:29:16
Even after this CL, m_executionContext here never
| |
| 189 bool m_overrideInlineStyleAllowed; | 189 bool m_overrideInlineStyleAllowed; |
| 190 CSPDirectiveListVector m_policies; | 190 CSPDirectiveListVector m_policies; |
| 191 | 191 |
| 192 HashSet<unsigned, AlreadyHashed> m_violationReportsSent; | 192 HashSet<unsigned, AlreadyHashed> m_violationReportsSent; |
| 193 | 193 |
| 194 // We put the hash functions used on the policy object so that we only need | 194 // We put the hash functions used on the policy object so that we only need |
| 195 // to calculate a hash once and then distribute it to all of the directives | 195 // to calculate a hash once and then distribute it to all of the directives |
| 196 // for validation. | 196 // for validation. |
| 197 uint8_t m_scriptHashAlgorithmsUsed; | 197 uint8_t m_scriptHashAlgorithmsUsed; |
| 198 uint8_t m_styleHashAlgorithmsUsed; | 198 uint8_t m_styleHashAlgorithmsUsed; |
| 199 }; | 199 }; |
| 200 | 200 |
| 201 } | 201 } |
| 202 | 202 |
| 203 #endif | 203 #endif |
| OLD | NEW |