| OLD | NEW |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "config.h" | 5 #include "config.h" |
| 6 #include "core/frame/csp/CSPDirectiveList.h" | 6 #include "core/frame/csp/CSPDirectiveList.h" |
| 7 | 7 |
| 8 #include "core/dom/Document.h" | 8 #include "core/dom/Document.h" |
| 9 #include "core/dom/SecurityContext.h" | 9 #include "core/dom/SecurityContext.h" |
| 10 #include "core/frame/LocalFrame.h" | 10 #include "core/frame/LocalFrame.h" |
| (...skipping 561 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 572 if (m_strictMixedContentCheckingEnforced) { | 572 if (m_strictMixedContentCheckingEnforced) { |
| 573 m_policy->reportDuplicateDirective(name); | 573 m_policy->reportDuplicateDirective(name); |
| 574 return; | 574 return; |
| 575 } | 575 } |
| 576 m_strictMixedContentCheckingEnforced = true; | 576 m_strictMixedContentCheckingEnforced = true; |
| 577 m_policy->enforceStrictMixedContentChecking(); | 577 m_policy->enforceStrictMixedContentChecking(); |
| 578 if (!value.isEmpty()) | 578 if (!value.isEmpty()) |
| 579 m_policy->reportValueForEmptyDirective(name, value); | 579 m_policy->reportValueForEmptyDirective(name, value); |
| 580 } | 580 } |
| 581 | 581 |
| 582 void CSPDirectiveList::enableInsecureContentUpgrade(const String& name, const St
ring& value) | 582 void CSPDirectiveList::enableInsecureRequestsUpgrade(const String& name, const S
tring& value) |
| 583 { | 583 { |
| 584 if (m_reportOnly) { | 584 if (m_reportOnly) { |
| 585 m_policy->reportInvalidInReportOnly(name); | 585 m_policy->reportInvalidInReportOnly(name); |
| 586 return; | 586 return; |
| 587 } | 587 } |
| 588 if (m_upgradeInsecureRequests) { | 588 if (m_upgradeInsecureRequests) { |
| 589 m_policy->reportDuplicateDirective(name); | 589 m_policy->reportDuplicateDirective(name); |
| 590 return; | 590 return; |
| 591 } | 591 } |
| 592 m_upgradeInsecureRequests = true; | 592 m_upgradeInsecureRequests = true; |
| 593 | 593 |
| 594 m_policy->setInsecureContentPolicy(SecurityContext::InsecureContentUpgrade); | 594 m_policy->setInsecureRequestsPolicy(SecurityContext::InsecureRequestsUpgrade
); |
| 595 if (!value.isEmpty()) | 595 if (!value.isEmpty()) |
| 596 m_policy->reportValueForEmptyDirective(name, value); | 596 m_policy->reportValueForEmptyDirective(name, value); |
| 597 } | 597 } |
| 598 | 598 |
| 599 void CSPDirectiveList::parseReflectedXSS(const String& name, const String& value
) | 599 void CSPDirectiveList::parseReflectedXSS(const String& name, const String& value
) |
| 600 { | 600 { |
| 601 if (m_reflectedXSSDisposition != ReflectedXSSUnset) { | 601 if (m_reflectedXSSDisposition != ReflectedXSSUnset) { |
| 602 m_policy->reportDuplicateDirective(name); | 602 m_policy->reportDuplicateDirective(name); |
| 603 m_reflectedXSSDisposition = ReflectedXSSInvalid; | 603 m_reflectedXSSDisposition = ReflectedXSSInvalid; |
| 604 return; | 604 return; |
| (...skipping 135 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 740 } else if (equalIgnoringCase(name, ContentSecurityPolicy::ReflectedXSS)) { | 740 } else if (equalIgnoringCase(name, ContentSecurityPolicy::ReflectedXSS)) { |
| 741 parseReflectedXSS(name, value); | 741 parseReflectedXSS(name, value); |
| 742 } else if (equalIgnoringCase(name, ContentSecurityPolicy::Referrer)) { | 742 } else if (equalIgnoringCase(name, ContentSecurityPolicy::Referrer)) { |
| 743 parseReferrer(name, value); | 743 parseReferrer(name, value); |
| 744 } else if (m_policy->experimentalFeaturesEnabled()) { | 744 } else if (m_policy->experimentalFeaturesEnabled()) { |
| 745 if (equalIgnoringCase(name, ContentSecurityPolicy::ManifestSrc)) | 745 if (equalIgnoringCase(name, ContentSecurityPolicy::ManifestSrc)) |
| 746 setCSPDirective<SourceListDirective>(name, value, m_manifestSrc); | 746 setCSPDirective<SourceListDirective>(name, value, m_manifestSrc); |
| 747 else if (equalIgnoringCase(name, ContentSecurityPolicy::BlockAllMixedCon
tent)) | 747 else if (equalIgnoringCase(name, ContentSecurityPolicy::BlockAllMixedCon
tent)) |
| 748 enforceStrictMixedContentChecking(name, value); | 748 enforceStrictMixedContentChecking(name, value); |
| 749 else if (equalIgnoringCase(name, ContentSecurityPolicy::UpgradeInsecureR
equests)) | 749 else if (equalIgnoringCase(name, ContentSecurityPolicy::UpgradeInsecureR
equests)) |
| 750 enableInsecureContentUpgrade(name, value); | 750 enableInsecureRequestsUpgrade(name, value); |
| 751 else | 751 else |
| 752 m_policy->reportUnsupportedDirective(name); | 752 m_policy->reportUnsupportedDirective(name); |
| 753 } else { | 753 } else { |
| 754 m_policy->reportUnsupportedDirective(name); | 754 m_policy->reportUnsupportedDirective(name); |
| 755 } | 755 } |
| 756 } | 756 } |
| 757 | 757 |
| 758 | 758 |
| 759 } // namespace blink | 759 } // namespace blink |
| OLD | NEW |