Use C++11 features in ContentSecurityPolicy

Source/core/frame/csp/ContentSecurityPolicy.cpp

 /*
  * Copyright (C) 2011 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 118 matching lines @@
 }
 
 static ReferrerPolicy mergeReferrerPolicies(ReferrerPolicy a, ReferrerPolicy b)
 {
     if (a != b)
         return ReferrerPolicyNever;
     return a;
 }
 
 ContentSecurityPolicy::ContentSecurityPolicy()
-    : m_executionContext(0)
+    : m_executionContext(nullptr)
     , m_overrideInlineStyleAllowed(false)
     , m_scriptHashAlgorithmsUsed(ContentSecurityPolicyHashAlgorithmNone)
     , m_styleHashAlgorithmsUsed(ContentSecurityPolicyHashAlgorithmNone)
     , m_sandboxMask(0)
     , m_referrerPolicy(ReferrerPolicyDefault)
 {
 }
 
 void ContentSecurityPolicy::bindToExecutionContext(ExecutionContext* executionContext)
 {
@@ skipping 12 matching lines @@
     // parsing error messages, then poke at histograms.
     if (Document* document = this->document()) {
         document->enforceSandboxFlags(m_sandboxMask);
         if (didSetReferrerPolicy())
             document->setReferrerPolicy(m_referrerPolicy);
 
         for (const auto& consoleMessage : m_consoleMessages)
             m_executionContext->addConsoleMessage(consoleMessage);
         m_consoleMessages.clear();
 
-        for (const auto& cspDirective : m_policies)
-            UseCounter::count(*document, getUseCounterType(cspDirective->headerType()));
+        for (const auto& policy : m_policies)
+            UseCounter::count(*document, getUseCounterType(policy->headerType()));
     }
 
     // We disable 'eval()' even in the case of report-only policies, and rely on the check in the
     // V8Initializer::codeGenerationCheckCallbackInMainThread callback to determine whether the
     // call should execute or not.
     if (!m_disableEvalErrorMessage.isNull())
         m_executionContext->disableEval(m_disableEvalErrorMessage);
 }
 
 ContentSecurityPolicy::~ContentSecurityPolicy()
 {
 }
 
 Document* ContentSecurityPolicy::document() const
 {
-    return m_executionContext->isDocument() ? toDocument(m_executionContext) : 0;
+    return m_executionContext->isDocument() ? toDocument(m_executionContext) : nullptr;
 }
 
 void ContentSecurityPolicy::copyStateFrom(const ContentSecurityPolicy* other)
 {
     ASSERT(m_policies.isEmpty());
-    for (const auto& cspDirective : other->m_policies)
-        addPolicyFromHeaderValue(cspDirective->header(), cspDirective->headerType(), cspDirective->headerSource());
+    for (const auto& policy : other->m_policies)
+        addPolicyFromHeaderValue(policy->header(), policy->headerType(), policy->headerSource());
 }
 
 void ContentSecurityPolicy::didReceiveHeaders(const ContentSecurityPolicyResponseHeaders& headers)
 {
     if (!headers.contentSecurityPolicy().isEmpty())
         addPolicyFromHeaderValue(headers.contentSecurityPolicy(), ContentSecurityPolicyHeaderTypeEnforce, ContentSecurityPolicyHeaderSourceHTTP);
     if (!headers.contentSecurityPolicyReportOnly().isEmpty())
         addPolicyFromHeaderValue(headers.contentSecurityPolicyReportOnly(), ContentSecurityPolicyHeaderTypeReport, ContentSecurityPolicyHeaderSourceHTTP);
 }
 
@@ skipping 70 matching lines @@
 }
 
 ContentSecurityPolicyHeaderType ContentSecurityPolicy::deprecatedHeaderType() const
 {
     return m_policies.isEmpty() ? ContentSecurityPolicyHeaderTypeEnforce : m_policies[0]->headerType();
 }
 
 template<bool (CSPDirectiveList::*allowed)(ContentSecurityPolicy::ReportingStatus) const>
 bool isAllowedByAll(const CSPDirectiveListVector& policies, ContentSecurityPolicy::ReportingStatus reportingStatus)
 {
-    for (size_t i = 0; i < policies.size(); ++i) {
-        if (!(policies[i].get()->*allowed)(reportingStatus))
+    for (const auto& policy : policies) {
+        if (!(policy.get()->*allowed)(reportingStatus))
             return false;
     }
     return true;
 }
 
 template<bool (CSPDirectiveList::*allowed)(ScriptState* scriptState, ContentSecurityPolicy::ReportingStatus) const>
 bool isAllowedByAllWithState(const CSPDirectiveListVector& policies, ScriptState* scriptState, ContentSecurityPolicy::ReportingStatus reportingStatus)
 {
-    for (size_t i = 0; i < policies.size(); ++i) {
-        if (!(policies[i].get()->*allowed)(scriptState, reportingStatus))
+    for (const auto& policy : policies) {
+        if (!(policy.get()->*allowed)(scriptState, reportingStatus))
             return false;
     }
     return true;
 }
 
 template<bool (CSPDirectiveList::*allowed)(const String&, const WTF::OrdinalNumber&, ContentSecurityPolicy::ReportingStatus) const>
 bool isAllowedByAllWithContext(const CSPDirectiveListVector& policies, const String& contextURL, const WTF::OrdinalNumber& contextLine, ContentSecurityPolicy::ReportingStatus reportingStatus)
 {
-    for (size_t i = 0; i < policies.size(); ++i) {
-        if (!(policies[i].get()->*allowed)(contextURL, contextLine, reportingStatus))
+    for (const auto& policy : policies) {
+        if (!(policy.get()->*allowed)(contextURL, contextLine, reportingStatus))
             return false;
     }
     return true;
 }
 
 template<bool (CSPDirectiveList::*allowed)(const String&) const>
 bool isAllowedByAllWithNonce(const CSPDirectiveListVector& policies, const String& nonce)
 {
-    for (size_t i = 0; i < policies.size(); ++i) {
-        if (!(policies[i].get()->*allowed)(nonce))
+    for (const auto& policy : policies) {
+        if (!(policy.get()->*allowed)(nonce))
             return false;
     }
     return true;
 }
 
 template<bool (CSPDirectiveList::*allowed)(const CSPHashValue&) const>
 bool isAllowedByAllWithHash(const CSPDirectiveListVector& policies, const CSPHashValue& hashValue)
 {
-    for (size_t i = 0; i < policies.size(); ++i) {
-        if (!(policies[i].get()->*allowed)(hashValue))
+    for (const auto& policy : policies) {
+        if (!(policy.get()->*allowed)(hashValue))
             return false;
     }
     return true;
 }
 
 template<bool (CSPDirectiveList::*allowFromURL)(const KURL&, ContentSecurityPolicy::ReportingStatus) const>
 bool isAllowedByAllWithURL(const CSPDirectiveListVector& policies, const KURL& url, ContentSecurityPolicy::ReportingStatus reportingStatus)
 {
     if (SchemeRegistry::schemeShouldBypassContentSecurityPolicy(url.protocol()))
         return true;
 
-    for (size_t i = 0; i < policies.size(); ++i) {
-        if (!(policies[i].get()->*allowFromURL)(url, reportingStatus))
+    for (const auto& policy : policies) {
+        if (!(policy.get()->*allowFromURL)(url, reportingStatus))
             return false;
     }
     return true;
 }
 
 template<bool (CSPDirectiveList::*allowed)(LocalFrame*, const KURL&, ContentSecurityPolicy::ReportingStatus) const>
 bool isAllowedByAllWithFrame(const CSPDirectiveListVector& policies, LocalFrame* frame, const KURL& url, ContentSecurityPolicy::ReportingStatus reportingStatus)
 {
-    for (size_t i = 0; i < policies.size(); ++i) {
-        if (!(policies[i].get()->*allowed)(frame, url, reportingStatus))
+    for (const auto& policy : policies) {
+        if (!(policy.get()->*allowed)(frame, url, reportingStatus))
             return false;
     }
     return true;
 }
 
 template<bool (CSPDirectiveList::*allowed)(const CSPHashValue&) const>
 bool checkDigest(const String& source, uint8_t hashAlgorithmsUsed, const CSPDirectiveListVector& policies)
 {
     // Any additions or subtractions from this struct should also modify the
     // respective entries in the kSupportedPrefixes array in
@@ skipping 50 matching lines @@
     return isAllowedByAllWithContext<&CSPDirectiveList::allowInlineStyle>(m_policies, contextURL, contextLine, reportingStatus);
 }
 
 bool ContentSecurityPolicy::allowEval(ScriptState* scriptState, ContentSecurityPolicy::ReportingStatus reportingStatus) const
 {
     return isAllowedByAllWithState<&CSPDirectiveList::allowEval>(m_policies, scriptState, reportingStatus);
 }
 
 String ContentSecurityPolicy::evalDisabledErrorMessage() const
 {
-    for (size_t i = 0; i < m_policies.size(); ++i) {
-        if (!m_policies[i]->allowEval(0, SuppressReport))
-            return m_policies[i]->evalDisabledErrorMessage();
+    for (const auto& policy : m_policies) {
+        if (!policy->allowEval(0, SuppressReport))
+            return policy->evalDisabledErrorMessage();
     }
     return String();
 }
 
 bool ContentSecurityPolicy::allowPluginType(const String& type, const String& typeAttribute, const KURL& url, ContentSecurityPolicy::ReportingStatus reportingStatus) const
 {
-    for (size_t i = 0; i < m_policies.size(); ++i) {
-        if (!m_policies[i]->allowPluginType(type, typeAttribute, url, reportingStatus))
+    for (const auto& policy : m_policies) {
+        if (!policy->allowPluginType(type, typeAttribute, url, reportingStatus))
             return false;
     }
     return true;
 }
 
 bool ContentSecurityPolicy::allowScriptFromSource(const KURL& url, ContentSecurityPolicy::ReportingStatus reportingStatus) const
 {
     return isAllowedByAllWithURL<&CSPDirectiveList::allowScriptFromSource>(m_policies, url, reportingStatus);
 }
 
@@ skipping 100 matching lines @@
 }
 
 bool ContentSecurityPolicy::isActive() const
 {
     return !m_policies.isEmpty();
 }
 
 ReflectedXSSDisposition ContentSecurityPolicy::reflectedXSSDisposition() const
 {
     ReflectedXSSDisposition disposition = ReflectedXSSUnset;
-    for (size_t i = 0; i < m_policies.size(); ++i) {
-        if (m_policies[i]->reflectedXSSDisposition() > disposition)
-            disposition = std::max(disposition, m_policies[i]->reflectedXSSDisposition());
+    for (const auto& policy : m_policies) {
+        if (policy->reflectedXSSDisposition() > disposition)
+            disposition = std::max(disposition, policy->reflectedXSSDisposition());
     }
     return disposition;
 }
 
 ReferrerPolicy ContentSecurityPolicy::referrerPolicy() const
 {
-    ReferrerPolicy policy = ReferrerPolicyDefault;
+    ReferrerPolicy referrerPolicy = ReferrerPolicyDefault;
     bool first = true;
-    for (size_t i = 0; i < m_policies.size(); ++i) {
-        if (m_policies[i]->didSetReferrerPolicy()) {
+    for (const auto& policy : m_policies) {
+        if (policy->didSetReferrerPolicy()) {
             if (first)
-                policy = m_policies[i]->referrerPolicy();
+                referrerPolicy = policy->referrerPolicy();
             else
-                policy = mergeReferrerPolicies(policy, m_policies[i]->referrerPolicy());
+                referrerPolicy = mergeReferrerPolicies(referrerPolicy, policy->referrerPolicy());
         }
     }
-    return policy;
+    return referrerPolicy;
 }
 
 bool ContentSecurityPolicy::didSetReferrerPolicy() const
 {
-    for (size_t i = 0; i < m_policies.size(); ++i) {
-        if (m_policies[i]->didSetReferrerPolicy())
+    for (const auto& policy : m_policies) {
+        if (policy->didSetReferrerPolicy())
             return true;
     }
     return false;
 }
 
 SecurityOrigin* ContentSecurityPolicy::securityOrigin() const
 {
     return m_executionContext->securityContext().securityOrigin();
 }
 
@@ skipping 106 matching lines @@
 
     RefPtr<JSONObject> reportObject = JSONObject::create();
     reportObject->setObject("csp-report", cspReport.release());
     String stringifiedReport = reportObject->toJSONString();
 
     if (!shouldSendViolationReport(stringifiedReport))
         return;
 
     RefPtr<FormData> report = FormData::create(stringifiedReport.utf8());
 
-    for (size_t i = 0; i < reportEndpoints.size(); ++i) {
+    for (const String& endpoint : reportEndpoints) {
         // If we have a context frame we're dealing with 'frame-ancestors' and we don't have our
         // own execution context. Use the frame's document to complete the endpoint URL, overriding
         // its URL with the blocked document's URL.
         ASSERT(!contextFrame || !m_executionContext);
         ASSERT(!contextFrame || equalIgnoringCase(effectiveDirective, FrameAncestors));
-        KURL endpoint = contextFrame ? frame->document()->completeURLWithOverride(reportEndpoints[i], blockedURL) : completeURL(reportEndpoints[i]);
-        PingLoader::sendViolationReport(frame, completeURL(reportEndpoints[i]), report, PingLoader::ContentSecurityPolicyViolationReport);
+        KURL url = contextFrame ? frame->document()->completeURLWithOverride(endpoint, blockedURL) : completeURL(endpoint);
+        PingLoader::sendViolationReport(frame, url, report, PingLoader::ContentSecurityPolicyViolationReport);
     }
 
     didSendViolationReport(stringifiedReport);
 }
 
 void ContentSecurityPolicy::reportInvalidReferrer(const String& invalidValue)
 {
     logToConsole("The 'referrer' Content Security Policy directive has the invalid value \"" + invalidValue + "\". Valid values are \"no-referrer\", \"no-referrer-when-downgrade\", \"origin\", and \"unsafe-url\". Note that \"origin-when-cross-origin\" is not yet supported.");
 }
 
@@ skipping 151 matching lines @@
     // Collisions have no security impact, so we can save space by storing only the string's hash rather than the whole report.
     return !m_violationReportsSent.contains(report.impl()->hash());
 }
 
 void ContentSecurityPolicy::didSendViolationReport(const String& report)
 {
     m_violationReportsSent.add(report.impl()->hash());
 }
 
 } // namespace blink