OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #ifndef CHROME_COMMON_EXTENSIONS_CSP_VALIDATOR_H_ | 5 #ifndef CHROME_COMMON_EXTENSIONS_CSP_VALIDATOR_H_ |
6 #define CHROME_COMMON_EXTENSIONS_CSP_VALIDATOR_H_ | 6 #define CHROME_COMMON_EXTENSIONS_CSP_VALIDATOR_H_ |
7 | 7 |
8 #include <string> | 8 #include <string> |
9 | 9 |
10 #include "chrome/common/extensions/extension.h" | 10 #include "chrome/common/extensions/extension.h" |
| 11 #include "chrome/common/extensions/manifest.h" |
11 | 12 |
12 namespace extensions { | 13 namespace extensions { |
13 | 14 |
14 namespace csp_validator { | 15 namespace csp_validator { |
15 | 16 |
16 // Checks whether the given |policy| is legal for use in the extension system. | 17 // Checks whether the given |policy| is legal for use in the extension system. |
17 // This check just ensures that the policy doesn't contain any characters that | 18 // This check just ensures that the policy doesn't contain any characters that |
18 // will cause problems when we transmit the policy in an HTTP header. | 19 // will cause problems when we transmit the policy in an HTTP header. |
19 bool ContentSecurityPolicyIsLegal(const std::string& policy); | 20 bool ContentSecurityPolicyIsLegal(const std::string& policy); |
20 | 21 |
21 // Checks whether the given |policy| meets the minimum security requirements | 22 // Checks whether the given |policy| meets the minimum security requirements |
22 // for use in the extension system. | 23 // for use in the extension system. |
23 // | 24 // |
24 // Ideally, we would like to say that an XSS vulnerability in the extension | 25 // Ideally, we would like to say that an XSS vulnerability in the extension |
25 // should not be able to execute script, even in the precense of an active | 26 // should not be able to execute script, even in the precense of an active |
26 // network attacker. | 27 // network attacker. |
27 // | 28 // |
28 // However, we found that it broke too many deployed extensions to limit | 29 // However, we found that it broke too many deployed extensions to limit |
29 // 'unsafe-eval' in the script-src directive, so that is allowed as a special | 30 // 'unsafe-eval' in the script-src directive, so that is allowed as a special |
30 // case for extensions. Platform apps disallow it. | 31 // case for extensions. Platform apps disallow it. |
31 bool ContentSecurityPolicyIsSecure( | 32 bool ContentSecurityPolicyIsSecure( |
32 const std::string& policy, Extension::Type type); | 33 const std::string& policy, Manifest::Type type); |
33 | 34 |
34 // Checks whether the given |policy| enforces a unique origin sandbox as | 35 // Checks whether the given |policy| enforces a unique origin sandbox as |
35 // defined by http://www.whatwg.org/specs/web-apps/current-work/multipage/ | 36 // defined by http://www.whatwg.org/specs/web-apps/current-work/multipage/ |
36 // the-iframe-element.html#attr-iframe-sandbox. The policy must have the | 37 // the-iframe-element.html#attr-iframe-sandbox. The policy must have the |
37 // "sandbox" directive, and the sandbox tokens must not include | 38 // "sandbox" directive, and the sandbox tokens must not include |
38 // "allow-same-origin". Additional restrictions may be imposed depending on | 39 // "allow-same-origin". Additional restrictions may be imposed depending on |
39 // |type|. | 40 // |type|. |
40 bool ContentSecurityPolicyIsSandboxed( | 41 bool ContentSecurityPolicyIsSandboxed( |
41 const std::string& policy, Extension::Type type); | 42 const std::string& policy, Manifest::Type type); |
42 | 43 |
43 } // namespace csp_validator | 44 } // namespace csp_validator |
44 | 45 |
45 } // namespace extensions | 46 } // namespace extensions |
46 | 47 |
47 #endif // CHROME_COMMON_EXTENSIONS_CSP_VALIDATOR_H_ | 48 #endif // CHROME_COMMON_EXTENSIONS_CSP_VALIDATOR_H_ |
OLD | NEW |