| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright (C) 2011 Adam Barth. All Rights Reserved. | 2 * Copyright (C) 2011 Adam Barth. All Rights Reserved. |
| 3 * Copyright (C) 2011 Daniel Bates (dbates@intudata.com). | 3 * Copyright (C) 2011 Daniel Bates (dbates@intudata.com). |
| 4 * | 4 * |
| 5 * Redistribution and use in source and binary forms, with or without | 5 * Redistribution and use in source and binary forms, with or without |
| 6 * modification, are permitted provided that the following conditions | 6 * modification, are permitted provided that the following conditions |
| 7 * are met: | 7 * are met: |
| 8 * 1. Redistributions of source code must retain the above copyright | 8 * 1. Redistributions of source code must retain the above copyright |
| 9 * notice, this list of conditions and the following disclaimer. | 9 * notice, this list of conditions and the following disclaimer. |
| 10 * 2. Redistributions in binary form must reproduce the above copyright | 10 * 2. Redistributions in binary form must reproduce the above copyright |
| (...skipping 14 matching lines...) Expand all Loading... |
| 25 */ | 25 */ |
| 26 | 26 |
| 27 #include "config.h" | 27 #include "config.h" |
| 28 #include "core/html/parser/XSSAuditor.h" | 28 #include "core/html/parser/XSSAuditor.h" |
| 29 | 29 |
| 30 #include "core/HTMLNames.h" | 30 #include "core/HTMLNames.h" |
| 31 #include "core/SVGNames.h" | 31 #include "core/SVGNames.h" |
| 32 #include "core/XLinkNames.h" | 32 #include "core/XLinkNames.h" |
| 33 #include "core/dom/Document.h" | 33 #include "core/dom/Document.h" |
| 34 #include "core/frame/LocalFrame.h" | 34 #include "core/frame/LocalFrame.h" |
| 35 #include "core/frame/Settings.h" |
| 35 #include "core/frame/csp/ContentSecurityPolicy.h" | 36 #include "core/frame/csp/ContentSecurityPolicy.h" |
| 36 #include "core/html/HTMLParamElement.h" | 37 #include "core/html/HTMLParamElement.h" |
| 37 #include "core/html/parser/HTMLDocumentParser.h" | 38 #include "core/html/parser/HTMLDocumentParser.h" |
| 38 #include "core/html/parser/HTMLParserIdioms.h" | 39 #include "core/html/parser/HTMLParserIdioms.h" |
| 39 #include "core/html/parser/TextResourceDecoder.h" | 40 #include "core/html/parser/TextResourceDecoder.h" |
| 40 #include "core/html/parser/XSSAuditorDelegate.h" | 41 #include "core/html/parser/XSSAuditorDelegate.h" |
| 42 #include "core/inspector/ConsoleMessage.h" |
| 41 #include "core/loader/DocumentLoader.h" | 43 #include "core/loader/DocumentLoader.h" |
| 42 #include "core/frame/Settings.h" | |
| 43 #include "platform/JSONValues.h" | 44 #include "platform/JSONValues.h" |
| 44 #include "platform/network/FormData.h" | 45 #include "platform/network/FormData.h" |
| 45 #include "platform/text/DecodeEscapeSequences.h" | 46 #include "platform/text/DecodeEscapeSequences.h" |
| 46 #include "wtf/ASCIICType.h" | 47 #include "wtf/ASCIICType.h" |
| 47 #include "wtf/MainThread.h" | 48 #include "wtf/MainThread.h" |
| 48 | 49 |
| 49 namespace { | 50 namespace { |
| 50 | 51 |
| 51 // SecurityOrigin::urlWithUniqueSecurityOrigin() can't be used cross-thread, or
we'd use it instead. | 52 // SecurityOrigin::urlWithUniqueSecurityOrigin() can't be used cross-thread, or
we'd use it instead. |
| 52 const char kURLWithUniqueOrigin[] = "data:,"; | 53 const char kURLWithUniqueOrigin[] = "data:,"; |
| (...skipping 281 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 334 m_didSendValidXSSProtectionHeader = xssProtectionHeader != ReflectedXSSU
nset && xssProtectionHeader != ReflectedXSSInvalid; | 335 m_didSendValidXSSProtectionHeader = xssProtectionHeader != ReflectedXSSU
nset && xssProtectionHeader != ReflectedXSSInvalid; |
| 335 if ((xssProtectionHeader == FilterReflectedXSS || xssProtectionHeader ==
BlockReflectedXSS) && !reportURL.isEmpty()) { | 336 if ((xssProtectionHeader == FilterReflectedXSS || xssProtectionHeader ==
BlockReflectedXSS) && !reportURL.isEmpty()) { |
| 336 xssProtectionReportURL = document->completeURL(reportURL); | 337 xssProtectionReportURL = document->completeURL(reportURL); |
| 337 if (MixedContentChecker::isMixedContent(document->securityOrigin(),
xssProtectionReportURL)) { | 338 if (MixedContentChecker::isMixedContent(document->securityOrigin(),
xssProtectionReportURL)) { |
| 338 errorDetails = "insecure reporting URL for secure page"; | 339 errorDetails = "insecure reporting URL for secure page"; |
| 339 xssProtectionHeader = ReflectedXSSInvalid; | 340 xssProtectionHeader = ReflectedXSSInvalid; |
| 340 xssProtectionReportURL = KURL(); | 341 xssProtectionReportURL = KURL(); |
| 341 } | 342 } |
| 342 } | 343 } |
| 343 if (xssProtectionHeader == ReflectedXSSInvalid) | 344 if (xssProtectionHeader == ReflectedXSSInvalid) |
| 344 document->addConsoleMessage(SecurityMessageSource, ErrorMessageLevel
, "Error parsing header X-XSS-Protection: " + headerValue + ": " + errorDetails
+ " at character position " + String::format("%u", errorPosition) + ". The defa
ult protections will be applied."); | 345 document->addConsoleMessage(ConsoleMessage::create(SecurityMessageSo
urce, ErrorMessageLevel, "Error parsing header X-XSS-Protection: " + headerValue
+ ": " + errorDetails + " at character position " + String::format("%u", error
Position) + ". The default protections will be applied.")); |
| 345 | 346 |
| 346 ReflectedXSSDisposition cspHeader = document->contentSecurityPolicy()->r
eflectedXSSDisposition(); | 347 ReflectedXSSDisposition cspHeader = document->contentSecurityPolicy()->r
eflectedXSSDisposition(); |
| 347 m_didSendValidCSPHeader = cspHeader != ReflectedXSSUnset && cspHeader !=
ReflectedXSSInvalid; | 348 m_didSendValidCSPHeader = cspHeader != ReflectedXSSUnset && cspHeader !=
ReflectedXSSInvalid; |
| 348 | 349 |
| 349 m_xssProtection = combineXSSProtectionHeaderAndCSP(xssProtectionHeader,
cspHeader); | 350 m_xssProtection = combineXSSProtectionHeaderAndCSP(xssProtectionHeader,
cspHeader); |
| 350 // FIXME: Combine the two report URLs in some reasonable way. | 351 // FIXME: Combine the two report URLs in some reasonable way. |
| 351 if (auditorDelegate) | 352 if (auditorDelegate) |
| 352 auditorDelegate->setReportURL(xssProtectionReportURL.copy()); | 353 auditorDelegate->setReportURL(xssProtectionReportURL.copy()); |
| 353 | 354 |
| 354 FormData* httpBody = documentLoader->request().httpBody(); | 355 FormData* httpBody = documentLoader->request().httpBody(); |
| (...skipping 445 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 800 | 801 |
| 801 bool XSSAuditor::isSafeToSendToAnotherThread() const | 802 bool XSSAuditor::isSafeToSendToAnotherThread() const |
| 802 { | 803 { |
| 803 return m_documentURL.isSafeToSendToAnotherThread() | 804 return m_documentURL.isSafeToSendToAnotherThread() |
| 804 && m_decodedURL.isSafeToSendToAnotherThread() | 805 && m_decodedURL.isSafeToSendToAnotherThread() |
| 805 && m_decodedHTTPBody.isSafeToSendToAnotherThread() | 806 && m_decodedHTTPBody.isSafeToSendToAnotherThread() |
| 806 && m_httpBodyAsString.isSafeToSendToAnotherThread(); | 807 && m_httpBodyAsString.isSafeToSendToAnotherThread(); |
| 807 } | 808 } |
| 808 | 809 |
| 809 } // namespace WebCore | 810 } // namespace WebCore |
| OLD | NEW |