| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright (C) 2011 Google, Inc. All rights reserved. | 2 * Copyright (C) 2011 Google, Inc. All rights reserved. |
| 3 * | 3 * |
| 4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
| 5 * modification, are permitted provided that the following conditions | 5 * modification, are permitted provided that the following conditions |
| 6 * are met: | 6 * are met: |
| 7 * 1. Redistributions of source code must retain the above copyright | 7 * 1. Redistributions of source code must retain the above copyright |
| 8 * notice, this list of conditions and the following disclaimer. | 8 * notice, this list of conditions and the following disclaimer. |
| 9 * 2. Redistributions in binary form must reproduce the above copyright | 9 * 2. Redistributions in binary form must reproduce the above copyright |
| 10 * notice, this list of conditions and the following disclaimer in the | 10 * notice, this list of conditions and the following disclaimer in the |
| (...skipping 130 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 141 } | 141 } |
| 142 | 142 |
| 143 ContentSecurityPolicy::ContentSecurityPolicy() | 143 ContentSecurityPolicy::ContentSecurityPolicy() |
| 144 : m_executionContext(nullptr) | 144 : m_executionContext(nullptr) |
| 145 , m_overrideInlineStyleAllowed(false) | 145 , m_overrideInlineStyleAllowed(false) |
| 146 , m_scriptHashAlgorithmsUsed(ContentSecurityPolicyHashAlgorithmNone) | 146 , m_scriptHashAlgorithmsUsed(ContentSecurityPolicyHashAlgorithmNone) |
| 147 , m_styleHashAlgorithmsUsed(ContentSecurityPolicyHashAlgorithmNone) | 147 , m_styleHashAlgorithmsUsed(ContentSecurityPolicyHashAlgorithmNone) |
| 148 , m_sandboxMask(0) | 148 , m_sandboxMask(0) |
| 149 , m_enforceStrictMixedContentChecking(false) | 149 , m_enforceStrictMixedContentChecking(false) |
| 150 , m_referrerPolicy(ReferrerPolicyDefault) | 150 , m_referrerPolicy(ReferrerPolicyDefault) |
| 151 , m_insecureContentPolicy(SecurityContext::InsecureContentDoNotUpgrade) | 151 , m_insecureRequestsPolicy(SecurityContext::InsecureRequestsDoNotUpgrade) |
| 152 { | 152 { |
| 153 } | 153 } |
| 154 | 154 |
| 155 void ContentSecurityPolicy::bindToExecutionContext(ExecutionContext* executionCo
ntext) | 155 void ContentSecurityPolicy::bindToExecutionContext(ExecutionContext* executionCo
ntext) |
| 156 { | 156 { |
| 157 m_executionContext = executionContext; | 157 m_executionContext = executionContext; |
| 158 applyPolicySideEffectsToExecutionContext(); | 158 applyPolicySideEffectsToExecutionContext(); |
| 159 } | 159 } |
| 160 | 160 |
| 161 void ContentSecurityPolicy::applyPolicySideEffectsToExecutionContext() | 161 void ContentSecurityPolicy::applyPolicySideEffectsToExecutionContext() |
| 162 { | 162 { |
| 163 ASSERT(m_executionContext); | 163 ASSERT(m_executionContext); |
| 164 // Ensure that 'self' processes correctly. | 164 // Ensure that 'self' processes correctly. |
| 165 m_selfProtocol = securityOrigin()->protocol(); | 165 m_selfProtocol = securityOrigin()->protocol(); |
| 166 m_selfSource = adoptPtr(new CSPSource(this, m_selfProtocol, securityOrigin()
->host(), securityOrigin()->port(), String(), CSPSource::NoWildcard, CSPSource::
NoWildcard)); | 166 m_selfSource = adoptPtr(new CSPSource(this, m_selfProtocol, securityOrigin()
->host(), securityOrigin()->port(), String(), CSPSource::NoWildcard, CSPSource::
NoWildcard)); |
| 167 | 167 |
| 168 // If we're in a Document, set the referrer policy, mixed content checking,
and sandbox | 168 // If we're in a Document, set the referrer policy, mixed content checking,
and sandbox |
| 169 // flags, then dump all the parsing error messages, then poke at histograms. | 169 // flags, then dump all the parsing error messages, then poke at histograms. |
| 170 if (Document* document = this->document()) { | 170 if (Document* document = this->document()) { |
| 171 if (m_sandboxMask != SandboxNone) { | 171 if (m_sandboxMask != SandboxNone) { |
| 172 UseCounter::count(document, UseCounter::SandboxViaCSP); | 172 UseCounter::count(document, UseCounter::SandboxViaCSP); |
| 173 document->enforceSandboxFlags(m_sandboxMask); | 173 document->enforceSandboxFlags(m_sandboxMask); |
| 174 } | 174 } |
| 175 if (m_enforceStrictMixedContentChecking) | 175 if (m_enforceStrictMixedContentChecking) |
| 176 document->enforceStrictMixedContentChecking(); | 176 document->enforceStrictMixedContentChecking(); |
| 177 if (didSetReferrerPolicy()) | 177 if (didSetReferrerPolicy()) |
| 178 document->setReferrerPolicy(m_referrerPolicy); | 178 document->setReferrerPolicy(m_referrerPolicy); |
| 179 if (m_insecureContentPolicy > document->insecureContentPolicy()) | 179 if (m_insecureRequestsPolicy > document->insecureRequestsPolicy()) |
| 180 document->setInsecureContentPolicy(m_insecureContentPolicy); | 180 document->setInsecureRequestsPolicy(m_insecureRequestsPolicy); |
| 181 | 181 |
| 182 for (const auto& consoleMessage : m_consoleMessages) | 182 for (const auto& consoleMessage : m_consoleMessages) |
| 183 m_executionContext->addConsoleMessage(consoleMessage); | 183 m_executionContext->addConsoleMessage(consoleMessage); |
| 184 m_consoleMessages.clear(); | 184 m_consoleMessages.clear(); |
| 185 | 185 |
| 186 for (const auto& policy : m_policies) | 186 for (const auto& policy : m_policies) |
| 187 UseCounter::count(*document, getUseCounterType(policy->headerType())
); | 187 UseCounter::count(*document, getUseCounterType(policy->headerType())
); |
| 188 } | 188 } |
| 189 | 189 |
| 190 // We disable 'eval()' even in the case of report-only policies, and rely on
the check in the | 190 // We disable 'eval()' even in the case of report-only policies, and rely on
the check in the |
| (...skipping 434 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 625 void ContentSecurityPolicy::enforceSandboxFlags(SandboxFlags mask) | 625 void ContentSecurityPolicy::enforceSandboxFlags(SandboxFlags mask) |
| 626 { | 626 { |
| 627 m_sandboxMask |= mask; | 627 m_sandboxMask |= mask; |
| 628 } | 628 } |
| 629 | 629 |
| 630 void ContentSecurityPolicy::enforceStrictMixedContentChecking() | 630 void ContentSecurityPolicy::enforceStrictMixedContentChecking() |
| 631 { | 631 { |
| 632 m_enforceStrictMixedContentChecking = true; | 632 m_enforceStrictMixedContentChecking = true; |
| 633 } | 633 } |
| 634 | 634 |
| 635 void ContentSecurityPolicy::setInsecureContentPolicy(SecurityContext::InsecureCo
ntentPolicy policy) | 635 void ContentSecurityPolicy::setInsecureRequestsPolicy(SecurityContext::InsecureR
equestsPolicy policy) |
| 636 { | 636 { |
| 637 if (policy > m_insecureContentPolicy) | 637 if (policy > m_insecureRequestsPolicy) |
| 638 m_insecureContentPolicy = policy; | 638 m_insecureRequestsPolicy = policy; |
| 639 } | 639 } |
| 640 | 640 |
| 641 static String stripURLForUseInReport(Document* document, const KURL& url) | 641 static String stripURLForUseInReport(Document* document, const KURL& url) |
| 642 { | 642 { |
| 643 if (!url.isValid()) | 643 if (!url.isValid()) |
| 644 return String(); | 644 return String(); |
| 645 if (!url.isHierarchical() || url.protocolIs("file")) | 645 if (!url.isHierarchical() || url.protocolIs("file")) |
| 646 return url.protocol(); | 646 return url.protocol(); |
| 647 return document->securityOrigin()->canRequest(url) ? url.strippedForUseAsRef
errer() : SecurityOrigin::create(url)->toString(); | 647 return document->securityOrigin()->canRequest(url) ? url.strippedForUseAsRef
errer() : SecurityOrigin::create(url)->toString(); |
| 648 } | 648 } |
| (...skipping 269 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 918 // Collisions have no security impact, so we can save space by storing only
the string's hash rather than the whole report. | 918 // Collisions have no security impact, so we can save space by storing only
the string's hash rather than the whole report. |
| 919 return !m_violationReportsSent.contains(report.impl()->hash()); | 919 return !m_violationReportsSent.contains(report.impl()->hash()); |
| 920 } | 920 } |
| 921 | 921 |
| 922 void ContentSecurityPolicy::didSendViolationReport(const String& report) | 922 void ContentSecurityPolicy::didSendViolationReport(const String& report) |
| 923 { | 923 { |
| 924 m_violationReportsSent.add(report.impl()->hash()); | 924 m_violationReportsSent.add(report.impl()->hash()); |
| 925 } | 925 } |
| 926 | 926 |
| 927 } // namespace blink | 927 } // namespace blink |
| OLD | NEW |