Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(263)

Side by Side Diff: chrome/common/extensions/csp_validator.h

Issue 12093036: Move Extension Location and Type enums to Manifest, and move InstallWarning to its own file. (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: Created 7 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #ifndef CHROME_COMMON_EXTENSIONS_CSP_VALIDATOR_H_ 5 #ifndef CHROME_COMMON_EXTENSIONS_CSP_VALIDATOR_H_
6 #define CHROME_COMMON_EXTENSIONS_CSP_VALIDATOR_H_ 6 #define CHROME_COMMON_EXTENSIONS_CSP_VALIDATOR_H_
7 7
8 #include <string> 8 #include <string>
9 9
10 #include "chrome/common/extensions/extension.h" 10 #include "chrome/common/extensions/manifest.h"
11 11
12 namespace extensions { 12 namespace extensions {
13 13
14 namespace csp_validator { 14 namespace csp_validator {
15 15
16 // Checks whether the given |policy| is legal for use in the extension system. 16 // Checks whether the given |policy| is legal for use in the extension system.
17 // This check just ensures that the policy doesn't contain any characters that 17 // This check just ensures that the policy doesn't contain any characters that
18 // will cause problems when we transmit the policy in an HTTP header. 18 // will cause problems when we transmit the policy in an HTTP header.
19 bool ContentSecurityPolicyIsLegal(const std::string& policy); 19 bool ContentSecurityPolicyIsLegal(const std::string& policy);
20 20
21 // Checks whether the given |policy| meets the minimum security requirements 21 // Checks whether the given |policy| meets the minimum security requirements
22 // for use in the extension system. 22 // for use in the extension system.
23 // 23 //
24 // Ideally, we would like to say that an XSS vulnerability in the extension 24 // Ideally, we would like to say that an XSS vulnerability in the extension
25 // should not be able to execute script, even in the precense of an active 25 // should not be able to execute script, even in the precense of an active
26 // network attacker. 26 // network attacker.
27 // 27 //
28 // However, we found that it broke too many deployed extensions to limit 28 // However, we found that it broke too many deployed extensions to limit
29 // 'unsafe-eval' in the script-src directive, so that is allowed as a special 29 // 'unsafe-eval' in the script-src directive, so that is allowed as a special
30 // case for extensions. Platform apps disallow it. 30 // case for extensions. Platform apps disallow it.
31 bool ContentSecurityPolicyIsSecure( 31 bool ContentSecurityPolicyIsSecure(
32 const std::string& policy, Extension::Type type); 32 const std::string& policy, Manifest::Type type);
33 33
34 // Checks whether the given |policy| enforces a unique origin sandbox as 34 // Checks whether the given |policy| enforces a unique origin sandbox as
35 // defined by http://www.whatwg.org/specs/web-apps/current-work/multipage/ 35 // defined by http://www.whatwg.org/specs/web-apps/current-work/multipage/
36 // the-iframe-element.html#attr-iframe-sandbox. The policy must have the 36 // the-iframe-element.html#attr-iframe-sandbox. The policy must have the
37 // "sandbox" directive, and the sandbox tokens must not include 37 // "sandbox" directive, and the sandbox tokens must not include
38 // "allow-same-origin". Additional restrictions may be imposed depending on 38 // "allow-same-origin". Additional restrictions may be imposed depending on
39 // |type|. 39 // |type|.
40 bool ContentSecurityPolicyIsSandboxed( 40 bool ContentSecurityPolicyIsSandboxed(
41 const std::string& policy, Extension::Type type); 41 const std::string& policy, Manifest::Type type);
42 42
43 } // namespace csp_validator 43 } // namespace csp_validator
44 44
45 } // namespace extensions 45 } // namespace extensions
46 46
47 #endif // CHROME_COMMON_EXTENSIONS_CSP_VALIDATOR_H_ 47 #endif // CHROME_COMMON_EXTENSIONS_CSP_VALIDATOR_H_
OLDNEW
« no previous file with comments | « chrome/common/extensions/api/extension_api_unittest.cc ('k') | chrome/common/extensions/csp_validator.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698