Chromium Code Reviews| Index: Source/core/html/parser/XSSAuditor.cpp |
| diff --git a/Source/core/html/parser/XSSAuditor.cpp b/Source/core/html/parser/XSSAuditor.cpp |
| index 0a3c1b6124bb94c4cc4ca5faaded2123da42204f..f44fd4ff13a81c4a71c66c3e3efde9dd41e65146 100644 |
| --- a/Source/core/html/parser/XSSAuditor.cpp |
| +++ b/Source/core/html/parser/XSSAuditor.cpp |
| @@ -31,12 +31,12 @@ |
| #include "SVGNames.h" |
| #include "XLinkNames.h" |
| #include "core/dom/Document.h" |
| -#include "core/fetch/TextResourceDecoder.h" |
| #include "core/frame/ContentSecurityPolicy.h" |
| #include "core/frame/Frame.h" |
| #include "core/html/HTMLParamElement.h" |
| #include "core/html/parser/HTMLDocumentParser.h" |
| #include "core/html/parser/HTMLParserIdioms.h" |
| +#include "core/html/parser/TextResourceDecoder.h" |
| #include "core/html/parser/XSSAuditorDelegate.h" |
| #include "core/loader/DocumentLoader.h" |
| #include "core/frame/Settings.h" |
| @@ -220,9 +220,6 @@ void XSSAuditor::initForFragment() |
| void XSSAuditor::init(Document* document, XSSAuditorDelegate* auditorDelegate) |
| { |
| - const size_t miniumLengthForSuffixTree = 512; // FIXME: Tune this parameter. |
| - const int suffixTreeDepth = 5; |
| - |
| ASSERT(isMainThread()); |
| if (m_state != Uninitialized) |
| return; |
| @@ -257,11 +254,6 @@ void XSSAuditor::init(Document* document, XSSAuditorDelegate* auditorDelegate) |
| if (document->encoding().isValid()) |
| m_encoding = document->encoding(); |
| - m_decodedURL = fullyDecodeString(m_documentURL.string(), m_encoding); |
| - if (m_decodedURL.find(isRequiredForInjection) == kNotFound) |
| - m_decodedURL = String(); |
| - |
| - String httpBodyAsString; |
| if (DocumentLoader* documentLoader = document->frame()->loader().documentLoader()) { |
| DEFINE_STATIC_LOCAL(const AtomicString, XSSProtectionHeader, ("X-XSS-Protection", AtomicString::ConstructFromLiteral)); |
| const AtomicString& headerValue = documentLoader->response().httpHeaderField(XSSProtectionHeader); |
| @@ -292,22 +284,37 @@ void XSSAuditor::init(Document* document, XSSAuditorDelegate* auditorDelegate) |
| if (auditorDelegate) |
| auditorDelegate->setReportURL(xssProtectionReportURL.copy()); |
| FormData* httpBody = documentLoader->originalRequest().httpBody(); |
| - if (httpBody && !httpBody->isEmpty()) { |
| - httpBodyAsString = httpBody->flattenToString(); |
| - if (!httpBodyAsString.isEmpty()) { |
| - m_decodedHTTPBody = fullyDecodeString(httpBodyAsString, m_encoding); |
| - if (m_decodedHTTPBody.find(isRequiredForInjection) == kNotFound) |
| - m_decodedHTTPBody = String(); |
| - if (m_decodedHTTPBody.length() >= miniumLengthForSuffixTree) |
| - m_decodedHTTPBodySuffixTree = adoptPtr(new SuffixTree<ASCIICodebook>(m_decodedHTTPBody, suffixTreeDepth)); |
| - } |
| - } |
| + if (httpBody && !httpBody->isEmpty()) |
| + m_httpBodyAsString = httpBody->flattenToString(); |
| } |
| - if (m_decodedURL.isEmpty() && m_decodedHTTPBody.isEmpty()) { |
| - m_isEnabled = false; |
| + setEncoding(m_encoding); |
| +} |
| + |
| +void XSSAuditor::setEncoding(const WTF::TextEncoding& encoding) |
| +{ |
| + const size_t miniumLengthForSuffixTree = 512; // FIXME: Tune this parameter. |
| + const int suffixTreeDepth = 5; |
| + |
| + if (!encoding.isValid()) |
| return; |
| + |
| + m_encoding = encoding; |
| + |
| + m_decodedURL = fullyDecodeString(m_documentURL.string(), m_encoding); |
| + if (m_decodedURL.find(isRequiredForInjection) == kNotFound) |
| + m_decodedURL = String(); |
| + |
| + if (!m_httpBodyAsString.isEmpty()) { |
| + m_decodedHTTPBody = fullyDecodeString(m_httpBodyAsString, m_encoding); |
| + if (m_decodedHTTPBody.find(isRequiredForInjection) == kNotFound) |
| + m_decodedHTTPBody = String(); |
| + if (m_decodedHTTPBody.length() >= miniumLengthForSuffixTree) |
| + m_decodedHTTPBodySuffixTree = adoptPtr(new SuffixTree<ASCIICodebook>(m_decodedHTTPBody, suffixTreeDepth)); |
| } |
|
abarth-chromium
2013/12/15 05:50:00
Can you clear m_httpBodyAsString once we're done w
oystein (OOO til 10th of July)
2013/12/16 19:33:30
Done.
|
| + |
| + if (m_decodedURL.isEmpty() && m_decodedHTTPBody.isEmpty()) |
| + m_isEnabled = false; |
| } |
| PassOwnPtr<XSSInfo> XSSAuditor::filterToken(const FilterTokenRequest& request) |
| @@ -725,7 +732,8 @@ bool XSSAuditor::isSafeToSendToAnotherThread() const |
| { |
| return m_documentURL.isSafeToSendToAnotherThread() |
| && m_decodedURL.isSafeToSendToAnotherThread() |
| - && m_decodedHTTPBody.isSafeToSendToAnotherThread(); |
| + && m_decodedHTTPBody.isSafeToSendToAnotherThread() |
| + && m_httpBodyAsString.isSafeToSendToAnotherThread(); |
| } |
| } // namespace WebCore |