CSP: Separate side-effects of parsing from the parsing code.

Source/core/frame/csp/ContentSecurityPolicy.h

 /*
  * Copyright (C) 2011 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 66 matching lines @@
 
     // CSP 1.1 Directives
     static const char BaseURI[];
     static const char ChildSrc[];
     static const char FormAction[];
     static const char FrameAncestors[];
     static const char PluginTypes[];
     static const char ReflectedXSS[];
     static const char Referrer[];
 
+    enum ReportingStatus {
+        SendReport,
+        SuppressReport
+    };
+
+    enum SideEffectDisposition {
+        ApplySideEffectsToExecutionContext,
+        DoNotApplySideEffectsToExecutionContext
+    };
+
     static PassRefPtr<ContentSecurityPolicy> create(ExecutionContext* executionContext)
     {
         return adoptRef(new ContentSecurityPolicy(executionContext));
     }
     ~ContentSecurityPolicy();
 
     void copyStateFrom(const ContentSecurityPolicy*);
 
-    enum ReportingStatus {
-        SendReport,
-        SuppressReport
-    };
-
     void didReceiveHeaders(const ContentSecurityPolicyResponseHeaders&);
-    void didReceiveHeader(const String&, ContentSecurityPolicyHeaderType, ContentSecurityPolicyHeaderSource);
+    void didReceiveHeader(const String&, ContentSecurityPolicyHeaderType, ContentSecurityPolicyHeaderSource, SideEffectDisposition = ApplySideEffectsToExecutionContext);
 
     // These functions are wrong because they assume that there is only one header.
     // FIXME: Replace them with functions that return vectors.
     const String& deprecatedHeader() const;
     ContentSecurityPolicyHeaderType deprecatedHeaderType() const;
 
     bool allowJavaScriptURLs(const String& contextURL, const WTF::OrdinalNumber& contextLine, ReportingStatus = SendReport) const;
     bool allowInlineEventHandlers(const String& contextURL, const WTF::OrdinalNumber& contextLine, ReportingStatus = SendReport) const;
     bool allowInlineScript(const String& contextURL, const WTF::OrdinalNumber& contextLine, ReportingStatus = SendReport) const;
     bool allowInlineStyle(const String& contextURL, const WTF::OrdinalNumber& contextLine, ReportingStatus = SendReport) const;
@@ skipping 50 matching lines @@
     void reportInvalidInReportOnly(const String&) const;
     void reportInvalidReferrer(const String&) const;
     void reportReportOnlyInMeta(const String&) const;
     void reportMetaOutsideHead(const String&) const;
     void reportViolation(const String& directiveText, const String& effectiveDirective, const String& consoleMessage, const KURL& blockedURL, const Vector<KURL>& reportURIs, const String& header);
 
     void reportBlockedScriptExecutionToInspector(const String& directiveText) const;
 
     const KURL url() const;
     KURL completeURL(const String&) const;
-    void enforceSandboxFlags(SandboxFlags) const;
+    void enforceSandboxFlags(SandboxFlags);
     String evalDisabledErrorMessage() const;
 
     bool urlMatchesSelf(const KURL&) const;
     bool protocolMatchesSelf(const KURL&) const;
 
     bool experimentalFeaturesEnabled() const;
 
     static bool shouldBypassMainWorld(ExecutionContext*);
 
     static bool isDirectiveName(const String&);
 
     ExecutionContext* executionContext() const { return m_executionContext; }
 
 private:
     explicit ContentSecurityPolicy(ExecutionContext*);
 
+    void applyPolicySideEffectsToExecutionContext();
+
     Document* document() const;
     SecurityOrigin* securityOrigin() const;
 
     void logToConsole(const String& message, MessageLevel = ErrorMessageLevel) const;
     void addPolicyFromHeaderValue(const String&, ContentSecurityPolicyHeaderType, ContentSecurityPolicyHeaderSource);
 
     bool shouldSendViolationReport(const String&) const;
     void didSendViolationReport(const String&);
 
     ExecutionContext* m_executionContext;
     bool m_overrideInlineStyleAllowed;
     CSPDirectiveListVector m_policies;
 
     HashSet<unsigned, AlreadyHashed> m_violationReportsSent;
 
     // We put the hash functions used on the policy object so that we only need
     // to calculate a hash once and then distribute it to all of the directives
     // for validation.
     uint8_t m_scriptHashAlgorithmsUsed;
     uint8_t m_styleHashAlgorithmsUsed;
 
+    // State flags used to configure the environment after parsing a policy.
+    SandboxFlags m_sandboxMask;
+    ReferrerPolicy m_referrerPolicy;
+    String m_disableEvalErrorMessage;
+
     OwnPtr<CSPSource> m_selfSource;
 };
 
 }
 
 #endif