Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(121)

Side by Side Diff: Source/core/loader/DocumentThreadableLoader.cpp

Issue 666533005: DocumentThreadableLoader: Rename isAllowedByPolicy() to isAllowedByContentSecurityPolicy() (Closed) Base URL: https://chromium.googlesource.com/chromium/blink.git@master
Patch Set: Created 6 years, 2 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « Source/core/loader/DocumentThreadableLoader.h ('k') | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 /* 1 /*
2 * Copyright (C) 2011, 2012 Google Inc. All rights reserved. 2 * Copyright (C) 2011, 2012 Google Inc. All rights reserved.
3 * Copyright (C) 2013, Intel Corporation 3 * Copyright (C) 2013, Intel Corporation
4 * 4 *
5 * Redistribution and use in source and binary forms, with or without 5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions are 6 * modification, are permitted provided that the following conditions are
7 * met: 7 * met:
8 * 8 *
9 * * Redistributions of source code must retain the above copyright 9 * * Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer. 10 * notice, this list of conditions and the following disclaimer.
(...skipping 232 matching lines...) Expand 10 before | Expand all | Expand 10 after
243 243
244 RefPtr<DocumentThreadableLoader> protect(this); 244 RefPtr<DocumentThreadableLoader> protect(this);
245 245
246 // FIXME: Support redirect in Fetch API. 246 // FIXME: Support redirect in Fetch API.
247 if (resource->resourceRequest().requestContext() == blink::WebURLRequest::Re questContextFetch) { 247 if (resource->resourceRequest().requestContext() == blink::WebURLRequest::Re questContextFetch) {
248 m_client->didFailRedirectCheck(); 248 m_client->didFailRedirectCheck();
249 request = ResourceRequest(); 249 request = ResourceRequest();
250 return; 250 return;
251 } 251 }
252 252
253 if (!isAllowedByPolicy(request.url())) { 253 if (!isAllowedByContentSecurityPolicy(request.url())) {
254 m_client->didFailRedirectCheck(); 254 m_client->didFailRedirectCheck();
255 request = ResourceRequest(); 255 request = ResourceRequest();
256 m_requestStartedSeconds = 0.0; 256 m_requestStartedSeconds = 0.0;
257 return; 257 return;
258 } 258 }
259 259
260 // Allow same origin requests to continue after allowing clients to audit th e redirect. 260 // Allow same origin requests to continue after allowing clients to audit th e redirect.
261 if (isAllowedRedirect(request.url())) { 261 if (isAllowedRedirect(request.url())) {
262 if (m_client->isDocumentThreadableLoaderClient()) 262 if (m_client->isDocumentThreadableLoaderClient())
263 static_cast<DocumentThreadableLoaderClient*>(m_client)->willSendRequ est(request, redirectResponse); 263 static_cast<DocumentThreadableLoaderClient*>(m_client)->willSendRequ est(request, redirectResponse);
(...skipping 290 matching lines...) Expand 10 before | Expand all | Expand 10 after
554 // No exception for file:/// resources, see <rdar://problem/4962298>. 554 // No exception for file:/// resources, see <rdar://problem/4962298>.
555 // Also, if we have an HTTP response, then it wasn't a network error in fact . 555 // Also, if we have an HTTP response, then it wasn't a network error in fact .
556 if (!error.isNull() && !requestURL.isLocalFile() && response.httpStatusCode( ) <= 0) { 556 if (!error.isNull() && !requestURL.isLocalFile() && response.httpStatusCode( ) <= 0) {
557 m_client->didFail(error); 557 m_client->didFail(error);
558 return; 558 return;
559 } 559 }
560 560
561 // FIXME: A synchronous request does not tell us whether a redirect happened or not, so we guess by comparing the 561 // FIXME: A synchronous request does not tell us whether a redirect happened or not, so we guess by comparing the
562 // request and response URLs. This isn't a perfect test though, since a serv er can serve a redirect to the same URL that was 562 // request and response URLs. This isn't a perfect test though, since a serv er can serve a redirect to the same URL that was
563 // requested. Also comparing the request and response URLs as strings will f ail if the requestURL still has its credentials. 563 // requested. Also comparing the request and response URLs as strings will f ail if the requestURL still has its credentials.
564 if (requestURL != response.url() && (!isAllowedByPolicy(response.url()) || ! isAllowedRedirect(response.url()))) { 564 if (requestURL != response.url() && (!isAllowedByContentSecurityPolicy(respo nse.url()) || !isAllowedRedirect(response.url()))) {
565 m_client->didFailRedirectCheck(); 565 m_client->didFailRedirectCheck();
566 return; 566 return;
567 } 567 }
568 568
569 handleResponse(identifier, response); 569 handleResponse(identifier, response);
570 570
571 SharedBuffer* data = resource->resourceBuffer(); 571 SharedBuffer* data = resource->resourceBuffer();
572 if (data) 572 if (data)
573 handleReceivedData(data->data(), data->size()); 573 handleReceivedData(data->data(), data->size());
574 574
575 handleSuccessfulFinish(identifier, 0.0); 575 handleSuccessfulFinish(identifier, 0.0);
576 } 576 }
577 577
578 bool DocumentThreadableLoader::isAllowedRedirect(const KURL& url) const 578 bool DocumentThreadableLoader::isAllowedRedirect(const KURL& url) const
579 { 579 {
580 if (m_options.crossOriginRequestPolicy == AllowCrossOriginRequests) 580 if (m_options.crossOriginRequestPolicy == AllowCrossOriginRequests)
581 return true; 581 return true;
582 582
583 return m_sameOriginRequest && securityOrigin()->canRequest(url); 583 return m_sameOriginRequest && securityOrigin()->canRequest(url);
584 } 584 }
585 585
586 bool DocumentThreadableLoader::isAllowedByPolicy(const KURL& url) const 586 bool DocumentThreadableLoader::isAllowedByContentSecurityPolicy(const KURL& url) const
587 { 587 {
588 if (m_options.contentSecurityPolicyEnforcement != EnforceConnectSrcDirective ) 588 if (m_options.contentSecurityPolicyEnforcement != EnforceConnectSrcDirective )
589 return true; 589 return true;
590 return m_document.contentSecurityPolicy()->allowConnectToSource(url); 590 return m_document.contentSecurityPolicy()->allowConnectToSource(url);
591 } 591 }
592 592
593 StoredCredentials DocumentThreadableLoader::effectiveAllowCredentials() const 593 StoredCredentials DocumentThreadableLoader::effectiveAllowCredentials() const
594 { 594 {
595 if (m_forceDoNotAllowStoredCredentials) 595 if (m_forceDoNotAllowStoredCredentials)
596 return DoNotAllowStoredCredentials; 596 return DoNotAllowStoredCredentials;
597 return m_resourceLoaderOptions.allowCredentials; 597 return m_resourceLoaderOptions.allowCredentials;
598 } 598 }
599 599
600 SecurityOrigin* DocumentThreadableLoader::securityOrigin() const 600 SecurityOrigin* DocumentThreadableLoader::securityOrigin() const
601 { 601 {
602 return m_securityOrigin ? m_securityOrigin.get() : m_document.securityOrigin (); 602 return m_securityOrigin ? m_securityOrigin.get() : m_document.securityOrigin ();
603 } 603 }
604 604
605 } // namespace blink 605 } // namespace blink
OLDNEW
« no previous file with comments | « Source/core/loader/DocumentThreadableLoader.h ('k') | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698