CSP: Check <param> element values against the document's CSP before loading.

Source/core/html/HTMLPlugInElement.cpp

 /**
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 10 matching lines @@
  */
 
 #include "config.h"
 #include "core/html/HTMLPlugInElement.h"
 
 #include "CSSPropertyNames.h"
 #include "HTMLNames.h"
 #include "bindings/v8/ScriptController.h"
 #include "bindings/v8/npruntime_impl.h"
 #include "core/dom/Document.h"
+#include "core/dom/Node.h"
 #include "core/dom/PostAttachCallbacks.h"
 #include "core/events/Event.h"
 #include "core/frame/ContentSecurityPolicy.h"
 #include "core/frame/Frame.h"
 #include "core/html/HTMLImageLoader.h"
 #include "core/html/PluginDocument.h"
 #include "core/loader/FrameLoaderClient.h"
 #include "core/page/EventHandler.h"
 #include "core/page/Page.h"
 #include "core/page/Settings.h"
@@ skipping 359 matching lines @@
     if (url.isEmpty() && mimeType.isEmpty())
         return false;
 
     // FIXME: None of this code should use renderers!
     RenderEmbeddedObject* renderer = renderEmbeddedObject();
     ASSERT(renderer);
     if (!renderer)
         return false;
 
     KURL completedURL = document().completeURL(url);
+    if (!pluginIsLoadable(completedURL, mimeType))
+        return false;
 
     bool useFallback;
     if (shouldUsePlugin(completedURL, mimeType, renderer->hasFallbackContent(), useFallback))
         return loadPlugin(completedURL, mimeType, paramNames, paramValues, useFallback);
 
     // If the plug-in element already contains a subframe,
     // loadOrRedirectSubframe will re-use it. Otherwise, it will create a new
     // frame and set it as the RenderPart's widget, causing what was previously
     // in the widget to be torn down.
     return loadOrRedirectSubframe(completedURL, getNameAttribute(), true);
 }
 
 bool HTMLPlugInElement::loadPlugin(const KURL& url, const String& mimeType, const Vector<String>& paramNames, const Vector<String>& paramValues, bool useFallback)
 {
     Frame* frame = document().frame();
 
     if (!frame->loader().allowPlugins(AboutToInstantiatePlugin))
         return false;
 
-    if (!pluginIsLoadable(url, mimeType))
-        return false;
-
     RenderEmbeddedObject* renderer = renderEmbeddedObject();
     // FIXME: This code should not depend on renderer!
     if (!renderer || useFallback)
         return false;
 
     LOG(Plugins, "%p Plug-in URL: %s", this, m_url.utf8().data());
     LOG(Plugins, "   Loaded URL: %s", url.string().utf8().data());
     m_loadedUrl = url;
 
     IntSize contentSize = roundedIntSize(LayoutSize(renderer->contentWidth(), renderer->contentHeight()));
@@ skipping 25 matching lines @@
     }
 
     ObjectContentType objectType = document().frame()->loader().client()->objectContentType(url, mimeType, shouldPreferPlugInsForImages());
     // If an object's content can't be handled and it has no fallback, let
     // it be handled as a plugin to show the broken plugin icon.
     useFallback = objectType == ObjectContentNone && hasFallback;
     return objectType == ObjectContentNone || objectType == ObjectContentNetscapePlugin || objectType == ObjectContentOtherPlugin;
 
 }
 
+void HTMLPlugInElement::dispatchErrorEvent()
+{
+    if (document().isPluginDocument() && document().ownerElement())
+        document().ownerElement()->dispatchEvent(Event::create(EventTypeNames::error));
+    else
+        dispatchEvent(Event::create(EventTypeNames::error));
+}
+
 bool HTMLPlugInElement::pluginIsLoadable(const KURL& url, const String& mimeType)
 {
     Frame* frame = document().frame();
     Settings* settings = frame->settings();
     if (!settings)
         return false;
 
     if (MIMETypeRegistry::isJavaAppletMIMEType(mimeType) && !settings->isJavaEnabled())
         return false;
 
@@ skipping 11 matching lines @@
     if (!document().contentSecurityPolicy()->allowObjectFromSource(url)
         || !document().contentSecurityPolicy()->allowPluginType(mimeType, declaredMimeType, url)) {
         renderEmbeddedObject()->setPluginUnavailabilityReason(RenderEmbeddedObject::PluginBlockedByContentSecurityPolicy);
         return false;
     }
 
     return frame->loader().mixedContentChecker()->canRunInsecureContent(document().securityOrigin(), url);
 }
 
 }