| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved. | 2 * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved. |
| 3 * Copyright (C) 2011 Google Inc. All rights reserved. | 3 * Copyright (C) 2011 Google Inc. All rights reserved. |
| 4 * | 4 * |
| 5 * Redistribution and use in source and binary forms, with or without | 5 * Redistribution and use in source and binary forms, with or without |
| 6 * modification, are permitted provided that the following conditions | 6 * modification, are permitted provided that the following conditions |
| 7 * are met: | 7 * are met: |
| 8 * | 8 * |
| 9 * 1. Redistributions of source code must retain the above copyright | 9 * 1. Redistributions of source code must retain the above copyright |
| 10 * notice, this list of conditions and the following disclaimer. | 10 * notice, this list of conditions and the following disclaimer. |
| (...skipping 65 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 76 | 76 |
| 77 DocumentLoader::DocumentLoader(LocalFrame* frame, const ResourceRequest& req, co
nst SubstituteData& substituteData) | 77 DocumentLoader::DocumentLoader(LocalFrame* frame, const ResourceRequest& req, co
nst SubstituteData& substituteData) |
| 78 : m_frame(frame) | 78 : m_frame(frame) |
| 79 , m_fetcher(ResourceFetcher::create(this)) | 79 , m_fetcher(ResourceFetcher::create(this)) |
| 80 , m_originalRequest(req) | 80 , m_originalRequest(req) |
| 81 , m_substituteData(substituteData) | 81 , m_substituteData(substituteData) |
| 82 , m_request(req) | 82 , m_request(req) |
| 83 , m_committed(false) | 83 , m_committed(false) |
| 84 , m_isClientRedirect(false) | 84 , m_isClientRedirect(false) |
| 85 , m_replacesCurrentHistoryItem(false) | 85 , m_replacesCurrentHistoryItem(false) |
| 86 , m_navigationType(NavigationTypeOther) |
| 86 , m_loadingMainResource(false) | 87 , m_loadingMainResource(false) |
| 87 , m_timeOfLastDataReceived(0.0) | 88 , m_timeOfLastDataReceived(0.0) |
| 88 , m_applicationCacheHost(ApplicationCacheHost::create(this)) | 89 , m_applicationCacheHost(ApplicationCacheHost::create(this)) |
| 89 { | 90 { |
| 90 } | 91 } |
| 91 | 92 |
| 92 FrameLoader* DocumentLoader::frameLoader() const | 93 FrameLoader* DocumentLoader::frameLoader() const |
| 93 { | 94 { |
| 94 if (!m_frame) | 95 if (!m_frame) |
| 95 return 0; | 96 return 0; |
| (...skipping 198 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 294 bool DocumentLoader::isRedirectAfterPost(const ResourceRequest& newRequest, cons
t ResourceResponse& redirectResponse) | 295 bool DocumentLoader::isRedirectAfterPost(const ResourceRequest& newRequest, cons
t ResourceResponse& redirectResponse) |
| 295 { | 296 { |
| 296 int status = redirectResponse.httpStatusCode(); | 297 int status = redirectResponse.httpStatusCode(); |
| 297 if (((status >= 301 && status <= 303) || status == 307) | 298 if (((status >= 301 && status <= 303) || status == 307) |
| 298 && m_originalRequest.httpMethod() == "POST") | 299 && m_originalRequest.httpMethod() == "POST") |
| 299 return true; | 300 return true; |
| 300 | 301 |
| 301 return false; | 302 return false; |
| 302 } | 303 } |
| 303 | 304 |
| 304 bool DocumentLoader::shouldContinueForNavigationPolicy(const ResourceRequest& re
quest, ContentSecurityPolicyDisposition shouldCheckMainWorldContentSecurityPolic
y, bool isTransitionNavigation) | 305 bool DocumentLoader::shouldContinueForNavigationPolicy(const ResourceRequest& re
quest, ContentSecurityPolicyDisposition shouldCheckMainWorldContentSecurityPolic
y, NavigationPolicy policy, bool isTransitionNavigation) |
| 305 { | 306 { |
| 306 // Don't ask if we are loading an empty URL. | 307 // Don't ask if we are loading an empty URL. |
| 307 if (request.url().isEmpty() || m_substituteData.isValid()) | 308 if (request.url().isEmpty() || m_substituteData.isValid()) |
| 308 return true; | 309 return true; |
| 309 | 310 |
| 310 // If we're loading content into a subframe, check against the parent's Cont
ent Security Policy | 311 // If we're loading content into a subframe, check against the parent's Cont
ent Security Policy |
| 311 // and kill the load if that check fails, unless we should bypass the main w
orld's CSP. | 312 // and kill the load if that check fails, unless we should bypass the main w
orld's CSP. |
| 312 // FIXME: CSP checks are broken for OOPI. For now, this policy always allows
frames with a remote parent... | 313 // FIXME: CSP checks are broken for OOPI. For now, this policy always allows
frames with a remote parent... |
| 313 if ((shouldCheckMainWorldContentSecurityPolicy == CheckContentSecurityPolicy
) && (m_frame->deprecatedLocalOwner() && !m_frame->deprecatedLocalOwner()->docum
ent().contentSecurityPolicy()->allowChildFrameFromSource(request.url()))) { | 314 if ((shouldCheckMainWorldContentSecurityPolicy == CheckContentSecurityPolicy
) && (m_frame->deprecatedLocalOwner() && !m_frame->deprecatedLocalOwner()->docum
ent().contentSecurityPolicy()->allowChildFrameFromSource(request.url()))) { |
| 314 // Fire a load event, as timing attacks would otherwise reveal that the | 315 // Fire a load event, as timing attacks would otherwise reveal that the |
| 315 // frame was blocked. This way, it looks like every other cross-origin | 316 // frame was blocked. This way, it looks like every other cross-origin |
| 316 // page load. | 317 // page load. |
| 317 m_frame->document()->enforceSandboxFlags(SandboxOrigin); | 318 m_frame->document()->enforceSandboxFlags(SandboxOrigin); |
| 318 m_frame->owner()->dispatchLoad(); | 319 m_frame->owner()->dispatchLoad(); |
| 319 return false; | 320 return false; |
| 320 } | 321 } |
| 321 | 322 |
| 322 NavigationPolicy policy = m_triggeringAction.policy(); | |
| 323 policy = frameLoader()->client()->decidePolicyForNavigation(request, this, p
olicy, isTransitionNavigation); | 323 policy = frameLoader()->client()->decidePolicyForNavigation(request, this, p
olicy, isTransitionNavigation); |
| 324 if (policy == NavigationPolicyCurrentTab) | 324 if (policy == NavigationPolicyCurrentTab) |
| 325 return true; | 325 return true; |
| 326 if (policy == NavigationPolicyIgnore) | 326 if (policy == NavigationPolicyIgnore) |
| 327 return false; | 327 return false; |
| 328 if (!LocalDOMWindow::allowPopUp(*m_frame) && !UserGestureIndicator::processi
ngUserGesture()) | 328 if (!LocalDOMWindow::allowPopUp(*m_frame) && !UserGestureIndicator::processi
ngUserGesture()) |
| 329 return false; | 329 return false; |
| 330 frameLoader()->client()->loadURLExternally(request, policy); | 330 frameLoader()->client()->loadURLExternally(request, policy); |
| 331 return false; | 331 return false; |
| 332 } | 332 } |
| (...skipping 15 matching lines...) Expand all Loading... |
| 348 return type == NavigationTypeFormSubmitted || type == NavigationTypeFormResu
bmitted; | 348 return type == NavigationTypeFormSubmitted || type == NavigationTypeFormResu
bmitted; |
| 349 } | 349 } |
| 350 | 350 |
| 351 void DocumentLoader::willSendRequest(ResourceRequest& newRequest, const Resource
Response& redirectResponse) | 351 void DocumentLoader::willSendRequest(ResourceRequest& newRequest, const Resource
Response& redirectResponse) |
| 352 { | 352 { |
| 353 // Note that there are no asserts here as there are for the other callbacks.
This is due to the | 353 // Note that there are no asserts here as there are for the other callbacks.
This is due to the |
| 354 // fact that this "callback" is sent when starting every load, and the state
of callback | 354 // fact that this "callback" is sent when starting every load, and the state
of callback |
| 355 // deferrals plays less of a part in this function in preventing the bad beh
avior deferring | 355 // deferrals plays less of a part in this function in preventing the bad beh
avior deferring |
| 356 // callbacks is meant to prevent. | 356 // callbacks is meant to prevent. |
| 357 ASSERT(!newRequest.isNull()); | 357 ASSERT(!newRequest.isNull()); |
| 358 if (isFormSubmission(m_triggeringAction.type()) && !m_frame->document()->con
tentSecurityPolicy()->allowFormAction(newRequest.url())) { | 358 if (isFormSubmission(m_navigationType) && !m_frame->document()->contentSecur
ityPolicy()->allowFormAction(newRequest.url())) { |
| 359 cancelMainResourceLoad(ResourceError::cancelledError(newRequest.url())); | 359 cancelMainResourceLoad(ResourceError::cancelledError(newRequest.url())); |
| 360 return; | 360 return; |
| 361 } | 361 } |
| 362 | 362 |
| 363 ASSERT(timing()->fetchStart()); | 363 ASSERT(timing()->fetchStart()); |
| 364 if (!redirectResponse.isNull()) { | 364 if (!redirectResponse.isNull()) { |
| 365 // If the redirecting url is not allowed to display content from the tar
get origin, | 365 // If the redirecting url is not allowed to display content from the tar
get origin, |
| 366 // then block the redirect. | 366 // then block the redirect. |
| 367 RefPtr<SecurityOrigin> redirectingOrigin = SecurityOrigin::create(redire
ctResponse.url()); | 367 RefPtr<SecurityOrigin> redirectingOrigin = SecurityOrigin::create(redire
ctResponse.url()); |
| 368 if (!redirectingOrigin->canDisplay(newRequest.url())) { | 368 if (!redirectingOrigin->canDisplay(newRequest.url())) { |
| (...skipping 467 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 836 // This is only called by FrameLoader::replaceDocumentWhileExecutingJavaScriptUR
L() | 836 // This is only called by FrameLoader::replaceDocumentWhileExecutingJavaScriptUR
L() |
| 837 void DocumentLoader::replaceDocumentWhileExecutingJavaScriptURL(const DocumentIn
it& init, const String& source, Document* ownerDocument) | 837 void DocumentLoader::replaceDocumentWhileExecutingJavaScriptURL(const DocumentIn
it& init, const String& source, Document* ownerDocument) |
| 838 { | 838 { |
| 839 m_writer = createWriterFor(ownerDocument, init, mimeType(), m_writer ? m_wri
ter->encoding() : emptyAtom, true); | 839 m_writer = createWriterFor(ownerDocument, init, mimeType(), m_writer ? m_wri
ter->encoding() : emptyAtom, true); |
| 840 if (!source.isNull()) | 840 if (!source.isNull()) |
| 841 m_writer->appendReplacingData(source); | 841 m_writer->appendReplacingData(source); |
| 842 endWriting(m_writer.get()); | 842 endWriting(m_writer.get()); |
| 843 } | 843 } |
| 844 | 844 |
| 845 } // namespace blink | 845 } // namespace blink |
| OLD | NEW |