| Index: Source/core/html/parser/XSSAuditor.cpp
|
| diff --git a/Source/core/html/parser/XSSAuditor.cpp b/Source/core/html/parser/XSSAuditor.cpp
|
| index 0a3c1b6124bb94c4cc4ca5faaded2123da42204f..a08647e238ac9f8a1d806cacdf61f50b74555751 100644
|
| --- a/Source/core/html/parser/XSSAuditor.cpp
|
| +++ b/Source/core/html/parser/XSSAuditor.cpp
|
| @@ -31,12 +31,12 @@
|
| #include "SVGNames.h"
|
| #include "XLinkNames.h"
|
| #include "core/dom/Document.h"
|
| -#include "core/fetch/TextResourceDecoder.h"
|
| #include "core/frame/ContentSecurityPolicy.h"
|
| #include "core/frame/Frame.h"
|
| #include "core/html/HTMLParamElement.h"
|
| #include "core/html/parser/HTMLDocumentParser.h"
|
| #include "core/html/parser/HTMLParserIdioms.h"
|
| +#include "core/html/parser/TextResourceDecoder.h"
|
| #include "core/html/parser/XSSAuditorDelegate.h"
|
| #include "core/loader/DocumentLoader.h"
|
| #include "core/frame/Settings.h"
|
| @@ -220,9 +220,6 @@ void XSSAuditor::initForFragment()
|
|
|
| void XSSAuditor::init(Document* document, XSSAuditorDelegate* auditorDelegate)
|
| {
|
| - const size_t miniumLengthForSuffixTree = 512; // FIXME: Tune this parameter.
|
| - const int suffixTreeDepth = 5;
|
| -
|
| ASSERT(isMainThread());
|
| if (m_state != Uninitialized)
|
| return;
|
| @@ -257,11 +254,6 @@ void XSSAuditor::init(Document* document, XSSAuditorDelegate* auditorDelegate)
|
| if (document->encoding().isValid())
|
| m_encoding = document->encoding();
|
|
|
| - m_decodedURL = fullyDecodeString(m_documentURL.string(), m_encoding);
|
| - if (m_decodedURL.find(isRequiredForInjection) == kNotFound)
|
| - m_decodedURL = String();
|
| -
|
| - String httpBodyAsString;
|
| if (DocumentLoader* documentLoader = document->frame()->loader().documentLoader()) {
|
| DEFINE_STATIC_LOCAL(const AtomicString, XSSProtectionHeader, ("X-XSS-Protection", AtomicString::ConstructFromLiteral));
|
| const AtomicString& headerValue = documentLoader->response().httpHeaderField(XSSProtectionHeader);
|
| @@ -292,22 +284,38 @@ void XSSAuditor::init(Document* document, XSSAuditorDelegate* auditorDelegate)
|
| if (auditorDelegate)
|
| auditorDelegate->setReportURL(xssProtectionReportURL.copy());
|
| FormData* httpBody = documentLoader->originalRequest().httpBody();
|
| - if (httpBody && !httpBody->isEmpty()) {
|
| - httpBodyAsString = httpBody->flattenToString();
|
| - if (!httpBodyAsString.isEmpty()) {
|
| - m_decodedHTTPBody = fullyDecodeString(httpBodyAsString, m_encoding);
|
| - if (m_decodedHTTPBody.find(isRequiredForInjection) == kNotFound)
|
| - m_decodedHTTPBody = String();
|
| - if (m_decodedHTTPBody.length() >= miniumLengthForSuffixTree)
|
| - m_decodedHTTPBodySuffixTree = adoptPtr(new SuffixTree<ASCIICodebook>(m_decodedHTTPBody, suffixTreeDepth));
|
| - }
|
| - }
|
| + if (httpBody && !httpBody->isEmpty())
|
| + m_httpBodyAsString = httpBody->flattenToString();
|
| }
|
|
|
| - if (m_decodedURL.isEmpty() && m_decodedHTTPBody.isEmpty()) {
|
| - m_isEnabled = false;
|
| + setEncoding(m_encoding);
|
| +}
|
| +
|
| +void XSSAuditor::setEncoding(const WTF::TextEncoding& encoding)
|
| +{
|
| + const size_t miniumLengthForSuffixTree = 512; // FIXME: Tune this parameter.
|
| + const int suffixTreeDepth = 5;
|
| +
|
| + if (!encoding.isValid())
|
| return;
|
| +
|
| + m_encoding = encoding;
|
| +
|
| + m_decodedURL = fullyDecodeString(m_documentURL.string(), m_encoding);
|
| + if (m_decodedURL.find(isRequiredForInjection) == kNotFound)
|
| + m_decodedURL = String();
|
| +
|
| + if (!m_httpBodyAsString.isEmpty()) {
|
| + m_decodedHTTPBody = fullyDecodeString(m_httpBodyAsString, m_encoding);
|
| + m_httpBodyAsString = String();
|
| + if (m_decodedHTTPBody.find(isRequiredForInjection) == kNotFound)
|
| + m_decodedHTTPBody = String();
|
| + if (m_decodedHTTPBody.length() >= miniumLengthForSuffixTree)
|
| + m_decodedHTTPBodySuffixTree = adoptPtr(new SuffixTree<ASCIICodebook>(m_decodedHTTPBody, suffixTreeDepth));
|
| }
|
| +
|
| + if (m_decodedURL.isEmpty() && m_decodedHTTPBody.isEmpty())
|
| + m_isEnabled = false;
|
| }
|
|
|
| PassOwnPtr<XSSInfo> XSSAuditor::filterToken(const FilterTokenRequest& request)
|
| @@ -725,7 +733,8 @@ bool XSSAuditor::isSafeToSendToAnotherThread() const
|
| {
|
| return m_documentURL.isSafeToSendToAnotherThread()
|
| && m_decodedURL.isSafeToSendToAnotherThread()
|
| - && m_decodedHTTPBody.isSafeToSendToAnotherThread();
|
| + && m_decodedHTTPBody.isSafeToSendToAnotherThread()
|
| + && m_httpBodyAsString.isSafeToSendToAnotherThread();
|
| }
|
|
|
| } // namespace WebCore
|
|
|