Teach ContentSecurityPolicy about WebURLRequest::RequestContext.

Source/core/frame/csp/ContentSecurityPolicy.cpp

 /*
  * Copyright (C) 2011 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 403 matching lines @@
 void ContentSecurityPolicy::usesScriptHashAlgorithms(uint8_t algorithms)
 {
     m_scriptHashAlgorithmsUsed |= algorithms;
 }
 
 void ContentSecurityPolicy::usesStyleHashAlgorithms(uint8_t algorithms)
 {
     m_styleHashAlgorithmsUsed |= algorithms;
 }
 
+bool ContentSecurityPolicy::allowFromSource(const KURL& url, blink::WebURLRequest::RequestContext requestContext, ContentSecurityPolicy::ReportingStatus reportingStatus) const
+{
+    switch (requestContext) {
+    case blink::WebURLRequest::RequestContextFrame:
+    case blink::WebURLRequest::RequestContextIframe:
+        return allowChildFrameFromSource(url, reportingStatus);
+
+    case blink::WebURLRequest::RequestContextEmbed:
+    case blink::WebURLRequest::RequestContextObject:
+        return allowObjectFromSource(url, reportingStatus);
+
+    case blink::WebURLRequest::RequestContextFont:
+        return allowFontFromSource(url, reportingStatus);
+
+    case blink::WebURLRequest::RequestContextStyle:
+        return allowStyleFromSource(url, reportingStatus);
+
+    case blink::WebURLRequest::RequestContextBeacon:
+    case blink::WebURLRequest::RequestContextForm:
+    case blink::WebURLRequest::RequestContextPing:
+        return allowFormAction(url, reportingStatus);
+
+    case blink::WebURLRequest::RequestContextFavicon:
+    case blink::WebURLRequest::RequestContextImage:
+        return allowImageFromSource(url, reportingStatus);
+
+    case blink::WebURLRequest::RequestContextAudio:
+    case blink::WebURLRequest::RequestContextVideo:
+    case blink::WebURLRequest::RequestContextTrack:
+        return allowMediaFromSource(url, reportingStatus);
+
+    case blink::WebURLRequest::RequestContextXSLT:
+        ASSERT(RuntimeEnabledFeatures::xsltEnabled());
+    case blink::WebURLRequest::RequestContextScript:
+        return allowScriptFromSource(url, reportingStatus);
+
+    case blink::WebURLRequest::RequestContextServiceWorker:
+    case blink::WebURLRequest::RequestContextSharedWorker:
+    case blink::WebURLRequest::RequestContextWorker:
+        return allowWorkerContextFromSource(url, reportingStatus);
+
+    case blink::WebURLRequest::RequestContextEventSource:
+    case blink::WebURLRequest::RequestContextFetch:
+    case blink::WebURLRequest::RequestContextXMLHttpRequest:
+        return allowConnectToSource(url, reportingStatus);
+
+    // FIXME: Evaluate whether or not we can start applying 'object-src' restrictions to PPAPI requests, now that we can distinguish them.
+    case blink::WebURLRequest::RequestContextPlugin:
+        if (Document* document = this->document()) {
+            UseCounter::count(*document, allowObjectFromSource(url, SuppressReport) ? UseCounter::PPAPIRequestAllowedByObjectSrc : UseCounter::PPAPIRequestBypassedObjectSrc);
+        }
+        return true;
+
+    // FIXME: We should implement 'manifest-src' or something similar: http://w3c.github.io/manifest/#content-security-policy
+    case blink::WebURLRequest::RequestContextManifest:
+        return true;
+
+    // These resource types aren't directly affected by CSP:
+    case blink::WebURLRequest::RequestContextCSPReport:
+    case blink::WebURLRequest::RequestContextDownload:
+    case blink::WebURLRequest::RequestContextHyperlink:
+    case blink::WebURLRequest::RequestContextInternal:
+    case blink::WebURLRequest::RequestContextLocation:
+    case blink::WebURLRequest::RequestContextPrefetch:
+    case blink::WebURLRequest::RequestContextSubresource:
+    case blink::WebURLRequest::RequestContextUnspecified:
+        return true;
+    }
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
 bool ContentSecurityPolicy::allowObjectFromSource(const KURL& url, ContentSecurityPolicy::ReportingStatus reportingStatus) const
 {
     return isAllowedByAllWithURL<&CSPDirectiveList::allowObjectFromSource>(m_policies, url, reportingStatus);
 }
 
 bool ContentSecurityPolicy::allowChildFrameFromSource(const KURL& url, ContentSecurityPolicy::ReportingStatus reportingStatus) const
 {
     return isAllowedByAllWithURL<&CSPDirectiveList::allowChildFrameFromSource>(m_policies, url, reportingStatus);
 }
 
@@ skipping 347 matching lines @@
     // Collisions have no security impact, so we can save space by storing only the string's hash rather than the whole report.
     return !m_violationReportsSent.contains(report.impl()->hash());
 }
 
 void ContentSecurityPolicy::didSendViolationReport(const String& report)
 {
     m_violationReportsSent.add(report.impl()->hash());
 }
 
 } // namespace blink