Source/core/frame/csp/ContentSecurityPolicy.cpp - Issue 811773002: Mixed Content: Implement strict mode.

Unified Diff: Source/core/frame/csp/ContentSecurityPolicy.cpp

Issue 811773002: Mixed Content: Implement strict mode. (Closed) Base URL: https://chromium.googlesource.com/chromium/blink.git@master

Patch Set: Tests. Created 6 years ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View side-by-side diff with in-line comments

Download patch

Index: Source/core/frame/csp/ContentSecurityPolicy.cpp

diff --git a/Source/core/frame/csp/ContentSecurityPolicy.cpp b/Source/core/frame/csp/ContentSecurityPolicy.cpp

index 79942f6c40e6c4cf79efb91459ad7d5d7367a08e..ba5235d9515eaadf96442b21c6efc137753c865a 100644

--- a/Source/core/frame/csp/ContentSecurityPolicy.cpp

+++ b/Source/core/frame/csp/ContentSecurityPolicy.cpp

@@ -62,7 +62,7 @@

namespace blink {

-// CSP 1.0 Directives

+// CSP Level 1 Directives

const char ContentSecurityPolicy::ConnectSrc[] = "connect-src";

const char ContentSecurityPolicy::DefaultSrc[] = "default-src";

const char ContentSecurityPolicy::FontSrc[] = "font-src";

@@ -75,7 +75,7 @@ const char ContentSecurityPolicy::Sandbox[] = "sandbox";

const char ContentSecurityPolicy::ScriptSrc[] = "script-src";

const char ContentSecurityPolicy::StyleSrc[] = "style-src";

-// CSP 1.1 Directives

+// CSP Level 2 Directives

const char ContentSecurityPolicy::BaseURI[] = "base-uri";

const char ContentSecurityPolicy::ChildSrc[] = "child-src";

const char ContentSecurityPolicy::FormAction[] = "form-action";

@@ -88,6 +88,10 @@ const char ContentSecurityPolicy::Referrer[] = "referrer";

// https://w3c.github.io/manifest/#content-security-policy

const char ContentSecurityPolicy::ManifestSrc[] = "manifest-src";

+// Mixed Content Directive

+// https://w3c.github.io/webappsec/specs/mixedcontent/#strict-mode

+const char ContentSecurityPolicy::StrictMixedContentChecking[] = "strict-mixed-content-checking";

bool ContentSecurityPolicy::isDirectiveName(const String& name)

{

return (equalIgnoringCase(name, ConnectSrc)

@@ -109,7 +113,7 @@ bool ContentSecurityPolicy::isDirectiveName(const String& name)

|| equalIgnoringCase(name, ReflectedXSS)

|| equalIgnoringCase(name, Referrer)

|| equalIgnoringCase(name, ManifestSrc)

- );

+ || equalIgnoringCase(name, StrictMixedContentChecking));

}

static UseCounter::Feature getUseCounterType(ContentSecurityPolicyHeaderType type)

@@ -137,6 +141,7 @@ ContentSecurityPolicy::ContentSecurityPolicy()

, m_scriptHashAlgorithmsUsed(ContentSecurityPolicyHashAlgorithmNone)

, m_styleHashAlgorithmsUsed(ContentSecurityPolicyHashAlgorithmNone)

, m_sandboxMask(0)

+ , m_enforceStrictMixedContentChecking(false)

, m_referrerPolicy(ReferrerPolicyDefault)

{

}

@@ -154,10 +159,12 @@ void ContentSecurityPolicy::applyPolicySideEffectsToExecutionContext()

m_selfProtocol = securityOrigin()->protocol();

m_selfSource = adoptPtr(new CSPSource(this, m_selfProtocol, securityOrigin()->host(), securityOrigin()->port(), String(), CSPSource::NoWildcard, CSPSource::NoWildcard));

- // If we're in a Document, set the referrer policy and sandbox flags, then dump all the

- // parsing error messages, then poke at histograms.

+ // If we're in a Document, set the referrer policy, mixed content checking, and sandbox

+ // flags, then dump all the parsing error messages, then poke at histograms.

if (Document* document = this->document()) {

document->enforceSandboxFlags(m_sandboxMask);

+ if (m_enforceStrictMixedContentChecking)

+ document->enforceStrictMixedContentChecking();

if (didSetReferrerPolicy())

document->setReferrerPolicy(m_referrerPolicy);

@@ -599,6 +606,11 @@ void ContentSecurityPolicy::enforceSandboxFlags(SandboxFlags mask)

m_sandboxMask |= mask;

}

+void ContentSecurityPolicy::enforceStrictMixedContentChecking()

+ m_enforceStrictMixedContentChecking = true;

static String stripURLForUseInReport(Document* document, const KURL& url)

{

if (!url.isValid())

@@ -728,6 +740,11 @@ void ContentSecurityPolicy::reportMetaOutsideHead(const String& header)

logToConsole("The Content Security Policy '" + header + "' was delivered via a <meta> element outside the document's <head>, which is disallowed. The policy has been ignored.");

}

+void ContentSecurityPolicy::reportValueForEmptyDirective(const String& name, const String& value)

+ logToConsole("The Content Security Policy directive '" + name + "' should be empty, but was delivered with a value of '" + value + "'. The directive has been applied, and the value ignored.");

void ContentSecurityPolicy::reportInvalidInReportOnly(const String& name)

{

logToConsole("The Content Security Policy directive '" + name + "' is ignored when delivered in a report-only policy.");

« no previous file with comments | « Source/core/frame/csp/ContentSecurityPolicy.h ('k') | Source/core/loader/FrameLoader.h » ('j') | no next file with comments »