Use C++11 features in ContentSecurityPolicy

Source/core/frame/csp/ContentSecurityPolicy.cpp

 /*
  * Copyright (C) 2011 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 118 matching lines @@
 }
 
 static ReferrerPolicy mergeReferrerPolicies(ReferrerPolicy a, ReferrerPolicy b)
 {
     if (a != b)
         return ReferrerPolicyNever;
     return a;
 }
 
 ContentSecurityPolicy::ContentSecurityPolicy()
-    : m_executionContext(0)
+    : m_executionContext(nullptr)
     , m_overrideInlineStyleAllowed(false)
     , m_scriptHashAlgorithmsUsed(ContentSecurityPolicyHashAlgorithmNone)
     , m_styleHashAlgorithmsUsed(ContentSecurityPolicyHashAlgorithmNone)
     , m_sandboxMask(0)
     , m_referrerPolicy(ReferrerPolicyDefault)
 {
 }
 
 void ContentSecurityPolicy::bindToExecutionContext(ExecutionContext* executionContext)
 {
@@ skipping 29 matching lines @@
     if (!m_disableEvalErrorMessage.isNull())
         m_executionContext->disableEval(m_disableEvalErrorMessage);
 }
 
 ContentSecurityPolicy::~ContentSecurityPolicy()
 {
 }
 
 Document* ContentSecurityPolicy::document() const
 {
-    return m_executionContext->isDocument() ? toDocument(m_executionContext) : 0;
+    return m_executionContext->isDocument() ? toDocument(m_executionContext) : nullptr;
 }
 
 void ContentSecurityPolicy::copyStateFrom(const ContentSecurityPolicy* other)
 {
     ASSERT(m_policies.isEmpty());
     for (const auto& cspDirective : other->m_policies)
         addPolicyFromHeaderValue(cspDirective->header(), cspDirective->headerType(), cspDirective->headerSource());
 }
 
 void ContentSecurityPolicy::didReceiveHeaders(const ContentSecurityPolicyResponseHeaders& headers)
@@ skipping 77 matching lines @@
 }
 
 ContentSecurityPolicyHeaderType ContentSecurityPolicy::deprecatedHeaderType() const
 {
     return m_policies.isEmpty() ? ContentSecurityPolicyHeaderTypeEnforce : m_policies[0]->headerType();
 }
 
 template<bool (CSPDirectiveList::*allowed)(ContentSecurityPolicy::ReportingStatus) const>
 bool isAllowedByAll(const CSPDirectiveListVector& policies, ContentSecurityPolicy::ReportingStatus reportingStatus)
 {
-    for (size_t i = 0; i < policies.size(); ++i) {
-        if (!(policies[i].get()->*allowed)(reportingStatus))
+    for (const auto& cspDirective : policies) {
+        if (!(cspDirective.get()->*allowed)(reportingStatus))
             return false;
     }
     return true;
 }
 
 template<bool (CSPDirectiveList::*allowed)(ScriptState* scriptState, ContentSecurityPolicy::ReportingStatus) const>
 bool isAllowedByAllWithState(const CSPDirectiveListVector& policies, ScriptState* scriptState, ContentSecurityPolicy::ReportingStatus reportingStatus)
 {
-    for (size_t i = 0; i < policies.size(); ++i) {
-        if (!(policies[i].get()->*allowed)(scriptState, reportingStatus))
+    for (const auto& cspDirective : policies) {
+        if (!(cspDirective.get()->*allowed)(scriptState, reportingStatus))
             return false;
     }
     return true;
 }
 
 template<bool (CSPDirectiveList::*allowed)(const String&, const WTF::OrdinalNumber&, ContentSecurityPolicy::ReportingStatus) const>
 bool isAllowedByAllWithContext(const CSPDirectiveListVector& policies, const String& contextURL, const WTF::OrdinalNumber& contextLine, ContentSecurityPolicy::ReportingStatus reportingStatus)
 {
-    for (size_t i = 0; i < policies.size(); ++i) {
-        if (!(policies[i].get()->*allowed)(contextURL, contextLine, reportingStatus))
+    for (const auto& cspDirective : policies) {
+        if (!(cspDirective.get()->*allowed)(contextURL, contextLine, reportingStatus))
             return false;
     }
     return true;
 }
 
 template<bool (CSPDirectiveList::*allowed)(const String&) const>
 bool isAllowedByAllWithNonce(const CSPDirectiveListVector& policies, const String& nonce)
 {
-    for (size_t i = 0; i < policies.size(); ++i) {
-        if (!(policies[i].get()->*allowed)(nonce))
+    for (const auto& cspDirective : policies) {
+        if (!(cspDirective.get()->*allowed)(nonce))
             return false;
     }
     return true;
 }
 
 template<bool (CSPDirectiveList::*allowed)(const CSPHashValue&) const>
 bool isAllowedByAllWithHash(const CSPDirectiveListVector& policies, const CSPHashValue& hashValue)
 {
-    for (size_t i = 0; i < policies.size(); ++i) {
-        if (!(policies[i].get()->*allowed)(hashValue))
+    for (const auto& cspDirective : policies) {
+        if (!(cspDirective.get()->*allowed)(hashValue))
             return false;
     }
     return true;
 }
 
 template<bool (CSPDirectiveList::*allowFromURL)(const KURL&, ContentSecurityPolicy::ReportingStatus) const>
 bool isAllowedByAllWithURL(const CSPDirectiveListVector& policies, const KURL& url, ContentSecurityPolicy::ReportingStatus reportingStatus)
 {
     if (SchemeRegistry::schemeShouldBypassContentSecurityPolicy(url.protocol()))
         return true;
 
-    for (size_t i = 0; i < policies.size(); ++i) {
-        if (!(policies[i].get()->*allowFromURL)(url, reportingStatus))
+    for (const auto& cspDirective : policies) {
+        if (!(cspDirective.get()->*allowFromURL)(url, reportingStatus))
             return false;
     }
     return true;
 }
 
 template<bool (CSPDirectiveList::*allowed)(LocalFrame*, const KURL&, ContentSecurityPolicy::ReportingStatus) const>
 bool isAllowedByAllWithFrame(const CSPDirectiveListVector& policies, LocalFrame* frame, const KURL& url, ContentSecurityPolicy::ReportingStatus reportingStatus)
 {
-    for (size_t i = 0; i < policies.size(); ++i) {
-        if (!(policies[i].get()->*allowed)(frame, url, reportingStatus))
+    for (const auto& cspDirective : policies) {
+        if (!(cspDirective.get()->*allowed)(frame, url, reportingStatus))
             return false;
     }
     return true;
 }
 
 template<bool (CSPDirectiveList::*allowed)(const CSPHashValue&) const>
 bool checkDigest(const String& source, uint8_t hashAlgorithmsUsed, const CSPDirectiveListVector& policies)
 {
     // Any additions or subtractions from this struct should also modify the
     // respective entries in the kSupportedPrefixes array in
@@ skipping 50 matching lines @@
     return isAllowedByAllWithContext<&CSPDirectiveList::allowInlineStyle>(m_policies, contextURL, contextLine, reportingStatus);
 }
 
 bool ContentSecurityPolicy::allowEval(ScriptState* scriptState, ContentSecurityPolicy::ReportingStatus reportingStatus) const
 {
     return isAllowedByAllWithState<&CSPDirectiveList::allowEval>(m_policies, scriptState, reportingStatus);
 }
 
 String ContentSecurityPolicy::evalDisabledErrorMessage() const
 {
-    for (size_t i = 0; i < m_policies.size(); ++i) {
-        if (!m_policies[i]->allowEval(0, SuppressReport))
-            return m_policies[i]->evalDisabledErrorMessage();
+    for (const auto& cspDirective : m_policies) {
+        if (!cspDirective->allowEval(0, SuppressReport))
+            return cspDirective->evalDisabledErrorMessage();
     }
     return String();
 }
 
 bool ContentSecurityPolicy::allowPluginType(const String& type, const String& typeAttribute, const KURL& url, ContentSecurityPolicy::ReportingStatus reportingStatus) const
 {
-    for (size_t i = 0; i < m_policies.size(); ++i) {
-        if (!m_policies[i]->allowPluginType(type, typeAttribute, url, reportingStatus))
+    for (const auto& cspDirective : m_policies) {
+        if (!cspDirective->allowPluginType(type, typeAttribute, url, reportingStatus))
             return false;
     }
     return true;
 }
 
 bool ContentSecurityPolicy::allowScriptFromSource(const KURL& url, ContentSecurityPolicy::ReportingStatus reportingStatus) const
 {
     return isAllowedByAllWithURL<&CSPDirectiveList::allowScriptFromSource>(m_policies, url, reportingStatus);
 }
 
@@ skipping 100 matching lines @@
 }
 
 bool ContentSecurityPolicy::isActive() const
 {
     return !m_policies.isEmpty();
 }
 
 ReflectedXSSDisposition ContentSecurityPolicy::reflectedXSSDisposition() const
 {
     ReflectedXSSDisposition disposition = ReflectedXSSUnset;
-    for (size_t i = 0; i < m_policies.size(); ++i) {
-        if (m_policies[i]->reflectedXSSDisposition() > disposition)
-            disposition = std::max(disposition, m_policies[i]->reflectedXSSDisposition());
+    for (const auto& cspDirective : m_policies) {
+        if (cspDirective->reflectedXSSDisposition() > disposition)
+            disposition = std::max(disposition, cspDirective->reflectedXSSDisposition());
     }
     return disposition;
 }
 
 ReferrerPolicy ContentSecurityPolicy::referrerPolicy() const
 {
     ReferrerPolicy policy = ReferrerPolicyDefault;
     bool first = true;
-    for (size_t i = 0; i < m_policies.size(); ++i) {
-        if (m_policies[i]->didSetReferrerPolicy()) {
+    for (const auto& cspDirective : m_policies) {
+        if (cspDirective->didSetReferrerPolicy()) {
             if (first)
-                policy = m_policies[i]->referrerPolicy();
+                policy = cspDirective->referrerPolicy();
             else
-                policy = mergeReferrerPolicies(policy, m_policies[i]->referrerPolicy());
+                policy = mergeReferrerPolicies(policy, cspDirective->referrerPolicy());
         }
     }
     return policy;
 }
 
 bool ContentSecurityPolicy::didSetReferrerPolicy() const
 {
-    for (size_t i = 0; i < m_policies.size(); ++i) {
-        if (m_policies[i]->didSetReferrerPolicy())
+    for (const auto& cspDirective : m_policies) {

[Mike West, 2014/10/16 19:35:07]

Nit: Here, and pretty much everywhere else, s/cspDirective/policy/. m_policies
is a list of policies, each of which contains a list of directives. :)

+        if (cspDirective->didSetReferrerPolicy())
             return true;
     }
     return false;
 }
 
 SecurityOrigin* ContentSecurityPolicy::securityOrigin() const
 {
     return m_executionContext->securityContext().securityOrigin();
 }
 
@@ skipping 106 matching lines @@
 
     RefPtr<JSONObject> reportObject = JSONObject::create();
     reportObject->setObject("csp-report", cspReport.release());
     String stringifiedReport = reportObject->toJSONString();
 
     if (!shouldSendViolationReport(stringifiedReport))
         return;
 
     RefPtr<FormData> report = FormData::create(stringifiedReport.utf8());
 
-    for (size_t i = 0; i < reportEndpoints.size(); ++i) {
+    for (const String& endpoint : reportEndpoints) {
         // If we have a context frame we're dealing with 'frame-ancestors' and we don't have our
         // own execution context. Use the frame's document to complete the endpoint URL, overriding
         // its URL with the blocked document's URL.
         ASSERT(!contextFrame || !m_executionContext);
         ASSERT(!contextFrame || equalIgnoringCase(effectiveDirective, FrameAncestors));
-        KURL endpoint = contextFrame ? frame->document()->completeURLWithOverride(reportEndpoints[i], blockedURL) : completeURL(reportEndpoints[i]);
-        PingLoader::sendViolationReport(frame, completeURL(reportEndpoints[i]), report, PingLoader::ContentSecurityPolicyViolationReport);
+        // FIXME: What is the below line used for?
+        KURL url = contextFrame ? frame->document()->completeURLWithOverride(endpoint, blockedURL) : completeURL(endpoint);
+        PingLoader::sendViolationReport(frame, completeURL(endpoint), report, PingLoader::ContentSecurityPolicyViolationReport);

[Mike West, 2014/10/16 19:35:07]

Oops. Please s/completeURL(endpoint)/url/g in this line. It should be sending
the violation report to the result of #712.

     }
 
     didSendViolationReport(stringifiedReport);
 }
 
 void ContentSecurityPolicy::reportInvalidReferrer(const String& invalidValue)
 {
     logToConsole("The 'referrer' Content Security Policy directive has the invalid value \"" + invalidValue + "\". Valid values are \"no-referrer\", \"no-referrer-when-downgrade\", \"origin\", and \"unsafe-url\". Note that \"origin-when-cross-origin\" is not yet supported.");
 }
 
@@ skipping 151 matching lines @@
     // Collisions have no security impact, so we can save space by storing only the string's hash rather than the whole report.
     return !m_violationReportsSent.contains(report.impl()->hash());
 }
 
 void ContentSecurityPolicy::didSendViolationReport(const String& report)
 {
     m_violationReportsSent.add(report.impl()->hash());
 }
 
 } // namespace blink