Index: trunk/Source/core/frame/csp/ContentSecurityPolicy.cpp |
=================================================================== |
--- trunk/Source/core/frame/csp/ContentSecurityPolicy.cpp (revision 178796) |
+++ trunk/Source/core/frame/csp/ContentSecurityPolicy.cpp (working copy) |
@@ -421,78 +421,6 @@ |
m_styleHashAlgorithmsUsed |= algorithms; |
} |
-bool ContentSecurityPolicy::allowFromSource(const KURL& url, blink::WebURLRequest::RequestContext requestContext, ContentSecurityPolicy::ReportingStatus reportingStatus) const |
-{ |
- switch (requestContext) { |
- case blink::WebURLRequest::RequestContextFrame: |
- case blink::WebURLRequest::RequestContextIframe: |
- return allowChildFrameFromSource(url, reportingStatus); |
- |
- case blink::WebURLRequest::RequestContextEmbed: |
- case blink::WebURLRequest::RequestContextObject: |
- return allowObjectFromSource(url, reportingStatus); |
- |
- case blink::WebURLRequest::RequestContextFont: |
- return allowFontFromSource(url, reportingStatus); |
- |
- case blink::WebURLRequest::RequestContextStyle: |
- return allowStyleFromSource(url, reportingStatus); |
- |
- case blink::WebURLRequest::RequestContextBeacon: |
- case blink::WebURLRequest::RequestContextForm: |
- case blink::WebURLRequest::RequestContextPing: |
- return allowFormAction(url, reportingStatus); |
- |
- case blink::WebURLRequest::RequestContextFavicon: |
- case blink::WebURLRequest::RequestContextImage: |
- return allowImageFromSource(url, reportingStatus); |
- |
- case blink::WebURLRequest::RequestContextAudio: |
- case blink::WebURLRequest::RequestContextVideo: |
- case blink::WebURLRequest::RequestContextTrack: |
- return allowMediaFromSource(url, reportingStatus); |
- |
- case blink::WebURLRequest::RequestContextXSLT: |
- ASSERT(RuntimeEnabledFeatures::xsltEnabled()); |
- case blink::WebURLRequest::RequestContextScript: |
- return allowScriptFromSource(url, reportingStatus); |
- |
- case blink::WebURLRequest::RequestContextServiceWorker: |
- case blink::WebURLRequest::RequestContextSharedWorker: |
- case blink::WebURLRequest::RequestContextWorker: |
- return allowWorkerContextFromSource(url, reportingStatus); |
- |
- case blink::WebURLRequest::RequestContextEventSource: |
- case blink::WebURLRequest::RequestContextFetch: |
- case blink::WebURLRequest::RequestContextXMLHttpRequest: |
- return allowConnectToSource(url, reportingStatus); |
- |
- // FIXME: Evaluate whether or not we can start applying 'object-src' restrictions to PPAPI requests, now that we can distinguish them. |
- case blink::WebURLRequest::RequestContextPlugin: |
- if (Document* document = this->document()) { |
- UseCounter::count(*document, allowObjectFromSource(url, SuppressReport) ? UseCounter::PPAPIRequestAllowedByObjectSrc : UseCounter::PPAPIRequestBypassedObjectSrc); |
- } |
- return true; |
- |
- // FIXME: We should implement 'manifest-src' or something similar: http://w3c.github.io/manifest/#content-security-policy |
- case blink::WebURLRequest::RequestContextManifest: |
- return true; |
- |
- // These resource types aren't directly affected by CSP: |
- case blink::WebURLRequest::RequestContextCSPReport: |
- case blink::WebURLRequest::RequestContextDownload: |
- case blink::WebURLRequest::RequestContextHyperlink: |
- case blink::WebURLRequest::RequestContextInternal: |
- case blink::WebURLRequest::RequestContextLocation: |
- case blink::WebURLRequest::RequestContextPrefetch: |
- case blink::WebURLRequest::RequestContextSubresource: |
- case blink::WebURLRequest::RequestContextUnspecified: |
- return true; |
- } |
- ASSERT_NOT_REACHED(); |
- return false; |
-} |
- |
bool ContentSecurityPolicy::allowObjectFromSource(const KURL& url, ContentSecurityPolicy::ReportingStatus reportingStatus) const |
{ |
return isAllowedByAllWithURL<&CSPDirectiveList::allowObjectFromSource>(m_policies, url, reportingStatus); |