OLD | NEW |
1 /* | 1 /* |
2 * Copyright (C) 2011 Adam Barth. All Rights Reserved. | 2 * Copyright (C) 2011 Adam Barth. All Rights Reserved. |
3 * Copyright (C) 2011 Daniel Bates (dbates@intudata.com). | 3 * Copyright (C) 2011 Daniel Bates (dbates@intudata.com). |
4 * | 4 * |
5 * Redistribution and use in source and binary forms, with or without | 5 * Redistribution and use in source and binary forms, with or without |
6 * modification, are permitted provided that the following conditions | 6 * modification, are permitted provided that the following conditions |
7 * are met: | 7 * are met: |
8 * 1. Redistributions of source code must retain the above copyright | 8 * 1. Redistributions of source code must retain the above copyright |
9 * notice, this list of conditions and the following disclaimer. | 9 * notice, this list of conditions and the following disclaimer. |
10 * 2. Redistributions in binary form must reproduce the above copyright | 10 * 2. Redistributions in binary form must reproduce the above copyright |
(...skipping 14 matching lines...) Expand all Loading... |
25 */ | 25 */ |
26 | 26 |
27 #include "config.h" | 27 #include "config.h" |
28 #include "core/html/parser/XSSAuditor.h" | 28 #include "core/html/parser/XSSAuditor.h" |
29 | 29 |
30 #include "core/HTMLNames.h" | 30 #include "core/HTMLNames.h" |
31 #include "core/SVGNames.h" | 31 #include "core/SVGNames.h" |
32 #include "core/XLinkNames.h" | 32 #include "core/XLinkNames.h" |
33 #include "core/dom/Document.h" | 33 #include "core/dom/Document.h" |
34 #include "core/frame/LocalFrame.h" | 34 #include "core/frame/LocalFrame.h" |
| 35 #include "core/frame/Settings.h" |
35 #include "core/frame/csp/ContentSecurityPolicy.h" | 36 #include "core/frame/csp/ContentSecurityPolicy.h" |
36 #include "core/html/HTMLParamElement.h" | 37 #include "core/html/HTMLParamElement.h" |
37 #include "core/html/parser/HTMLDocumentParser.h" | 38 #include "core/html/parser/HTMLDocumentParser.h" |
38 #include "core/html/parser/HTMLParserIdioms.h" | 39 #include "core/html/parser/HTMLParserIdioms.h" |
39 #include "core/html/parser/TextResourceDecoder.h" | 40 #include "core/html/parser/TextResourceDecoder.h" |
40 #include "core/html/parser/XSSAuditorDelegate.h" | 41 #include "core/html/parser/XSSAuditorDelegate.h" |
| 42 #include "core/inspector/ConsoleMessage.h" |
41 #include "core/loader/DocumentLoader.h" | 43 #include "core/loader/DocumentLoader.h" |
42 #include "core/frame/Settings.h" | |
43 #include "platform/JSONValues.h" | 44 #include "platform/JSONValues.h" |
44 #include "platform/network/FormData.h" | 45 #include "platform/network/FormData.h" |
45 #include "platform/text/DecodeEscapeSequences.h" | 46 #include "platform/text/DecodeEscapeSequences.h" |
46 #include "wtf/ASCIICType.h" | 47 #include "wtf/ASCIICType.h" |
47 #include "wtf/MainThread.h" | 48 #include "wtf/MainThread.h" |
48 | 49 |
49 namespace { | 50 namespace { |
50 | 51 |
51 // SecurityOrigin::urlWithUniqueSecurityOrigin() can't be used cross-thread, or
we'd use it instead. | 52 // SecurityOrigin::urlWithUniqueSecurityOrigin() can't be used cross-thread, or
we'd use it instead. |
52 const char kURLWithUniqueOrigin[] = "data:,"; | 53 const char kURLWithUniqueOrigin[] = "data:,"; |
(...skipping 285 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
338 m_didSendValidXSSProtectionHeader = xssProtectionHeader != ReflectedXSSU
nset && xssProtectionHeader != ReflectedXSSInvalid; | 339 m_didSendValidXSSProtectionHeader = xssProtectionHeader != ReflectedXSSU
nset && xssProtectionHeader != ReflectedXSSInvalid; |
339 if ((xssProtectionHeader == FilterReflectedXSS || xssProtectionHeader ==
BlockReflectedXSS) && !reportURL.isEmpty()) { | 340 if ((xssProtectionHeader == FilterReflectedXSS || xssProtectionHeader ==
BlockReflectedXSS) && !reportURL.isEmpty()) { |
340 xssProtectionReportURL = document->completeURL(reportURL); | 341 xssProtectionReportURL = document->completeURL(reportURL); |
341 if (MixedContentChecker::isMixedContent(document->securityOrigin(),
xssProtectionReportURL)) { | 342 if (MixedContentChecker::isMixedContent(document->securityOrigin(),
xssProtectionReportURL)) { |
342 errorDetails = "insecure reporting URL for secure page"; | 343 errorDetails = "insecure reporting URL for secure page"; |
343 xssProtectionHeader = ReflectedXSSInvalid; | 344 xssProtectionHeader = ReflectedXSSInvalid; |
344 xssProtectionReportURL = KURL(); | 345 xssProtectionReportURL = KURL(); |
345 } | 346 } |
346 } | 347 } |
347 if (xssProtectionHeader == ReflectedXSSInvalid) | 348 if (xssProtectionHeader == ReflectedXSSInvalid) |
348 document->addConsoleMessage(SecurityMessageSource, ErrorMessageLevel
, "Error parsing header X-XSS-Protection: " + headerValue + ": " + errorDetails
+ " at character position " + String::format("%u", errorPosition) + ". The defa
ult protections will be applied."); | 349 document->addConsoleMessage(ConsoleMessage::create(SecurityMessageSo
urce, ErrorMessageLevel, "Error parsing header X-XSS-Protection: " + headerValue
+ ": " + errorDetails + " at character position " + String::format("%u", error
Position) + ". The default protections will be applied.")); |
349 | 350 |
350 ReflectedXSSDisposition cspHeader = document->contentSecurityPolicy()->r
eflectedXSSDisposition(); | 351 ReflectedXSSDisposition cspHeader = document->contentSecurityPolicy()->r
eflectedXSSDisposition(); |
351 m_didSendValidCSPHeader = cspHeader != ReflectedXSSUnset && cspHeader !=
ReflectedXSSInvalid; | 352 m_didSendValidCSPHeader = cspHeader != ReflectedXSSUnset && cspHeader !=
ReflectedXSSInvalid; |
352 | 353 |
353 m_xssProtection = combineXSSProtectionHeaderAndCSP(xssProtectionHeader,
cspHeader); | 354 m_xssProtection = combineXSSProtectionHeaderAndCSP(xssProtectionHeader,
cspHeader); |
354 // FIXME: Combine the two report URLs in some reasonable way. | 355 // FIXME: Combine the two report URLs in some reasonable way. |
355 if (auditorDelegate) | 356 if (auditorDelegate) |
356 auditorDelegate->setReportURL(xssProtectionReportURL.copy()); | 357 auditorDelegate->setReportURL(xssProtectionReportURL.copy()); |
357 | 358 |
358 FormData* httpBody = documentLoader->request().httpBody(); | 359 FormData* httpBody = documentLoader->request().httpBody(); |
(...skipping 445 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
804 | 805 |
805 bool XSSAuditor::isSafeToSendToAnotherThread() const | 806 bool XSSAuditor::isSafeToSendToAnotherThread() const |
806 { | 807 { |
807 return m_documentURL.isSafeToSendToAnotherThread() | 808 return m_documentURL.isSafeToSendToAnotherThread() |
808 && m_decodedURL.isSafeToSendToAnotherThread() | 809 && m_decodedURL.isSafeToSendToAnotherThread() |
809 && m_decodedHTTPBody.isSafeToSendToAnotherThread() | 810 && m_decodedHTTPBody.isSafeToSendToAnotherThread() |
810 && m_httpBodyAsString.isSafeToSendToAnotherThread(); | 811 && m_httpBodyAsString.isSafeToSendToAnotherThread(); |
811 } | 812 } |
812 | 813 |
813 } // namespace blink | 814 } // namespace blink |
OLD | NEW |