Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(86)

Side by Side Diff: Source/core/frame/csp/ContentSecurityPolicy.cpp

Issue 980213002: Rename InsecureContentPolicy to InsecureRequestsPolicy. (Closed) Base URL: svn://svn.chromium.org/blink/trunk
Patch Set: Created 5 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
OLDNEW
1 /* 1 /*
2 * Copyright (C) 2011 Google, Inc. All rights reserved. 2 * Copyright (C) 2011 Google, Inc. All rights reserved.
3 * 3 *
4 * Redistribution and use in source and binary forms, with or without 4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions 5 * modification, are permitted provided that the following conditions
6 * are met: 6 * are met:
7 * 1. Redistributions of source code must retain the above copyright 7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer. 8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright 9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the 10 * notice, this list of conditions and the following disclaimer in the
(...skipping 130 matching lines...) Expand 10 before | Expand all | Expand 10 after
141 } 141 }
142 142
143 ContentSecurityPolicy::ContentSecurityPolicy() 143 ContentSecurityPolicy::ContentSecurityPolicy()
144 : m_executionContext(nullptr) 144 : m_executionContext(nullptr)
145 , m_overrideInlineStyleAllowed(false) 145 , m_overrideInlineStyleAllowed(false)
146 , m_scriptHashAlgorithmsUsed(ContentSecurityPolicyHashAlgorithmNone) 146 , m_scriptHashAlgorithmsUsed(ContentSecurityPolicyHashAlgorithmNone)
147 , m_styleHashAlgorithmsUsed(ContentSecurityPolicyHashAlgorithmNone) 147 , m_styleHashAlgorithmsUsed(ContentSecurityPolicyHashAlgorithmNone)
148 , m_sandboxMask(0) 148 , m_sandboxMask(0)
149 , m_enforceStrictMixedContentChecking(false) 149 , m_enforceStrictMixedContentChecking(false)
150 , m_referrerPolicy(ReferrerPolicyDefault) 150 , m_referrerPolicy(ReferrerPolicyDefault)
151 , m_insecureContentPolicy(SecurityContext::InsecureContentDoNotUpgrade) 151 , m_insecureRequestsPolicy(SecurityContext::InsecureRequestsDoNotUpgrade)
152 { 152 {
153 } 153 }
154 154
155 void ContentSecurityPolicy::bindToExecutionContext(ExecutionContext* executionCo ntext) 155 void ContentSecurityPolicy::bindToExecutionContext(ExecutionContext* executionCo ntext)
156 { 156 {
157 m_executionContext = executionContext; 157 m_executionContext = executionContext;
158 applyPolicySideEffectsToExecutionContext(); 158 applyPolicySideEffectsToExecutionContext();
159 } 159 }
160 160
161 void ContentSecurityPolicy::applyPolicySideEffectsToExecutionContext() 161 void ContentSecurityPolicy::applyPolicySideEffectsToExecutionContext()
162 { 162 {
163 ASSERT(m_executionContext); 163 ASSERT(m_executionContext);
164 // Ensure that 'self' processes correctly. 164 // Ensure that 'self' processes correctly.
165 m_selfProtocol = securityOrigin()->protocol(); 165 m_selfProtocol = securityOrigin()->protocol();
166 m_selfSource = adoptPtr(new CSPSource(this, m_selfProtocol, securityOrigin() ->host(), securityOrigin()->port(), String(), CSPSource::NoWildcard, CSPSource:: NoWildcard)); 166 m_selfSource = adoptPtr(new CSPSource(this, m_selfProtocol, securityOrigin() ->host(), securityOrigin()->port(), String(), CSPSource::NoWildcard, CSPSource:: NoWildcard));
167 167
168 // If we're in a Document, set the referrer policy, mixed content checking, and sandbox 168 // If we're in a Document, set the referrer policy, mixed content checking, and sandbox
169 // flags, then dump all the parsing error messages, then poke at histograms. 169 // flags, then dump all the parsing error messages, then poke at histograms.
170 if (Document* document = this->document()) { 170 if (Document* document = this->document()) {
171 if (m_sandboxMask != SandboxNone) { 171 if (m_sandboxMask != SandboxNone) {
172 UseCounter::count(document, UseCounter::SandboxViaCSP); 172 UseCounter::count(document, UseCounter::SandboxViaCSP);
173 document->enforceSandboxFlags(m_sandboxMask); 173 document->enforceSandboxFlags(m_sandboxMask);
174 } 174 }
175 if (m_enforceStrictMixedContentChecking) 175 if (m_enforceStrictMixedContentChecking)
176 document->enforceStrictMixedContentChecking(); 176 document->enforceStrictMixedContentChecking();
177 if (didSetReferrerPolicy()) 177 if (didSetReferrerPolicy())
178 document->setReferrerPolicy(m_referrerPolicy); 178 document->setReferrerPolicy(m_referrerPolicy);
179 if (m_insecureContentPolicy > document->insecureContentPolicy()) 179 if (m_insecureRequestsPolicy > document->insecureRequestsPolicy())
180 document->setInsecureContentPolicy(m_insecureContentPolicy); 180 document->setInsecureRequestsPolicy(m_insecureRequestsPolicy);
181 181
182 for (const auto& consoleMessage : m_consoleMessages) 182 for (const auto& consoleMessage : m_consoleMessages)
183 m_executionContext->addConsoleMessage(consoleMessage); 183 m_executionContext->addConsoleMessage(consoleMessage);
184 m_consoleMessages.clear(); 184 m_consoleMessages.clear();
185 185
186 for (const auto& policy : m_policies) 186 for (const auto& policy : m_policies)
187 UseCounter::count(*document, getUseCounterType(policy->headerType()) ); 187 UseCounter::count(*document, getUseCounterType(policy->headerType()) );
188 } 188 }
189 189
190 // We disable 'eval()' even in the case of report-only policies, and rely on the check in the 190 // We disable 'eval()' even in the case of report-only policies, and rely on the check in the
(...skipping 434 matching lines...) Expand 10 before | Expand all | Expand 10 after
625 void ContentSecurityPolicy::enforceSandboxFlags(SandboxFlags mask) 625 void ContentSecurityPolicy::enforceSandboxFlags(SandboxFlags mask)
626 { 626 {
627 m_sandboxMask |= mask; 627 m_sandboxMask |= mask;
628 } 628 }
629 629
630 void ContentSecurityPolicy::enforceStrictMixedContentChecking() 630 void ContentSecurityPolicy::enforceStrictMixedContentChecking()
631 { 631 {
632 m_enforceStrictMixedContentChecking = true; 632 m_enforceStrictMixedContentChecking = true;
633 } 633 }
634 634
635 void ContentSecurityPolicy::setInsecureContentPolicy(SecurityContext::InsecureCo ntentPolicy policy) 635 void ContentSecurityPolicy::setInsecureRequestsPolicy(SecurityContext::InsecureR equestsPolicy policy)
636 { 636 {
637 if (policy > m_insecureContentPolicy) 637 if (policy > m_insecureRequestsPolicy)
638 m_insecureContentPolicy = policy; 638 m_insecureRequestsPolicy = policy;
639 } 639 }
640 640
641 static String stripURLForUseInReport(Document* document, const KURL& url) 641 static String stripURLForUseInReport(Document* document, const KURL& url)
642 { 642 {
643 if (!url.isValid()) 643 if (!url.isValid())
644 return String(); 644 return String();
645 if (!url.isHierarchical() || url.protocolIs("file")) 645 if (!url.isHierarchical() || url.protocolIs("file"))
646 return url.protocol(); 646 return url.protocol();
647 return document->securityOrigin()->canRequest(url) ? url.strippedForUseAsRef errer() : SecurityOrigin::create(url)->toString(); 647 return document->securityOrigin()->canRequest(url) ? url.strippedForUseAsRef errer() : SecurityOrigin::create(url)->toString();
648 } 648 }
(...skipping 269 matching lines...) Expand 10 before | Expand all | Expand 10 after
918 // Collisions have no security impact, so we can save space by storing only the string's hash rather than the whole report. 918 // Collisions have no security impact, so we can save space by storing only the string's hash rather than the whole report.
919 return !m_violationReportsSent.contains(report.impl()->hash()); 919 return !m_violationReportsSent.contains(report.impl()->hash());
920 } 920 }
921 921
922 void ContentSecurityPolicy::didSendViolationReport(const String& report) 922 void ContentSecurityPolicy::didSendViolationReport(const String& report)
923 { 923 {
924 m_violationReportsSent.add(report.impl()->hash()); 924 m_violationReportsSent.add(report.impl()->hash());
925 } 925 }
926 926
927 } // namespace blink 927 } // namespace blink
OLDNEW
« no previous file with comments | « Source/core/frame/csp/ContentSecurityPolicy.h ('k') | Source/core/frame/csp/ContentSecurityPolicyTest.cpp » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698