| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright (C) 2011 Google, Inc. All rights reserved. | 2 * Copyright (C) 2011 Google, Inc. All rights reserved. |
| 3 * | 3 * |
| 4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
| 5 * modification, are permitted provided that the following conditions | 5 * modification, are permitted provided that the following conditions |
| 6 * are met: | 6 * are met: |
| 7 * 1. Redistributions of source code must retain the above copyright | 7 * 1. Redistributions of source code must retain the above copyright |
| 8 * notice, this list of conditions and the following disclaimer. | 8 * notice, this list of conditions and the following disclaimer. |
| 9 * 2. Redistributions in binary form must reproduce the above copyright | 9 * 2. Redistributions in binary form must reproduce the above copyright |
| 10 * notice, this list of conditions and the following disclaimer in the | 10 * notice, this list of conditions and the following disclaimer in the |
| (...skipping 18 matching lines...) Expand all Loading... |
| 29 #include "Console.h" | 29 #include "Console.h" |
| 30 #include "DOMStringList.h" | 30 #include "DOMStringList.h" |
| 31 #include "Document.h" | 31 #include "Document.h" |
| 32 #include "UseCounter.h" | 32 #include "UseCounter.h" |
| 33 #include "FormData.h" | 33 #include "FormData.h" |
| 34 #include "FormDataList.h" | 34 #include "FormDataList.h" |
| 35 #include "Frame.h" | 35 #include "Frame.h" |
| 36 #include "InspectorInstrumentation.h" | 36 #include "InspectorInstrumentation.h" |
| 37 #include "InspectorValues.h" | 37 #include "InspectorValues.h" |
| 38 #include "KURL.h" | 38 #include "KURL.h" |
| 39 #include "PageConsole.h" |
| 39 #include "PingLoader.h" | 40 #include "PingLoader.h" |
| 40 #include "RuntimeEnabledFeatures.h" | 41 #include "RuntimeEnabledFeatures.h" |
| 41 #include "SchemeRegistry.h" | 42 #include "SchemeRegistry.h" |
| 42 #include "ScriptCallStack.h" | 43 #include "ScriptCallStack.h" |
| 43 #include "ScriptCallStackFactory.h" | 44 #include "ScriptCallStackFactory.h" |
| 44 #include "ScriptState.h" | 45 #include "ScriptState.h" |
| 45 #include "SecurityOrigin.h" | 46 #include "SecurityOrigin.h" |
| 46 #include "SecurityPolicyViolationEvent.h" | 47 #include "SecurityPolicyViolationEvent.h" |
| 47 #include "TextEncoding.h" | 48 #include "TextEncoding.h" |
| 48 #include <wtf/HashSet.h> | 49 #include <wtf/HashSet.h> |
| (...skipping 1401 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1450 { | 1451 { |
| 1451 ASSERT(m_policies.isEmpty()); | 1452 ASSERT(m_policies.isEmpty()); |
| 1452 for (CSPDirectiveListVector::const_iterator iter = other->m_policies.begin()
; iter != other->m_policies.end(); ++iter) | 1453 for (CSPDirectiveListVector::const_iterator iter = other->m_policies.begin()
; iter != other->m_policies.end(); ++iter) |
| 1453 didReceiveHeader((*iter)->header(), (*iter)->headerType()); | 1454 didReceiveHeader((*iter)->header(), (*iter)->headerType()); |
| 1454 } | 1455 } |
| 1455 | 1456 |
| 1456 void ContentSecurityPolicy::didReceiveHeader(const String& header, HeaderType ty
pe) | 1457 void ContentSecurityPolicy::didReceiveHeader(const String& header, HeaderType ty
pe) |
| 1457 { | 1458 { |
| 1458 if (m_scriptExecutionContext->isDocument()) { | 1459 if (m_scriptExecutionContext->isDocument()) { |
| 1459 Document* document = toDocument(m_scriptExecutionContext); | 1460 Document* document = toDocument(m_scriptExecutionContext); |
| 1460 if (document->domWindow()) | 1461 UseCounter::observe(document, getUseCounterType(type)); |
| 1461 UseCounter::observe(document->domWindow(), getUseCounterType(type)); | 1462 |
| 1463 if (type == PrefixedReport || type == PrefixedEnforce) |
| 1464 PageConsole::reportDeprecation(document, PageConsole::PrefixedConten
tSecurityPolicyHeader); |
| 1462 } | 1465 } |
| 1463 | 1466 |
| 1464 if (type == PrefixedReport || type == PrefixedEnforce) | |
| 1465 reportDeprecatedHeader(type); | |
| 1466 | |
| 1467 // RFC2616, section 4.2 specifies that headers appearing multiple times can | 1467 // RFC2616, section 4.2 specifies that headers appearing multiple times can |
| 1468 // be combined with a comma. Walk the header string, and parse each comma | 1468 // be combined with a comma. Walk the header string, and parse each comma |
| 1469 // separated chunk as a separate header. | 1469 // separated chunk as a separate header. |
| 1470 const UChar* begin = header.characters(); | 1470 const UChar* begin = header.characters(); |
| 1471 const UChar* position = begin; | 1471 const UChar* position = begin; |
| 1472 const UChar* end = begin + header.length(); | 1472 const UChar* end = begin + header.length(); |
| 1473 while (position < end) { | 1473 while (position < end) { |
| 1474 skipUntil(position, end, ','); | 1474 skipUntil(position, end, ','); |
| 1475 | 1475 |
| 1476 // header1,header2 OR header1 | 1476 // header1,header2 OR header1 |
| (...skipping 320 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1797 if (equalIgnoringCase(name, allow)) | 1797 if (equalIgnoringCase(name, allow)) |
| 1798 message = allowMessage; | 1798 message = allowMessage; |
| 1799 else if (equalIgnoringCase(name, options)) | 1799 else if (equalIgnoringCase(name, options)) |
| 1800 message = optionsMessage; | 1800 message = optionsMessage; |
| 1801 else if (equalIgnoringCase(name, policyURI)) | 1801 else if (equalIgnoringCase(name, policyURI)) |
| 1802 message = policyURIMessage; | 1802 message = policyURIMessage; |
| 1803 | 1803 |
| 1804 logToConsole(message); | 1804 logToConsole(message); |
| 1805 } | 1805 } |
| 1806 | 1806 |
| 1807 void ContentSecurityPolicy::reportDeprecatedHeader(HeaderType type) const | |
| 1808 { | |
| 1809 ASSERT(type == PrefixedEnforce || type == PrefixedReport); | |
| 1810 logToConsole(makeString("The '", type == PrefixedEnforce ? "X-WebKit-CSP" :
"X-WebKit-CSP-Report-Only", "' header is deprecated. Please consider using the u
nprefixed '", type == PrefixedEnforce ? "Content-Security-Policy" : "Content-Sec
urity-Policy-Report-Only", "' header instead.")); | |
| 1811 } | |
| 1812 | |
| 1813 void ContentSecurityPolicy::reportDirectiveAsSourceExpression(const String& dire
ctiveName, const String& sourceExpression) const | 1807 void ContentSecurityPolicy::reportDirectiveAsSourceExpression(const String& dire
ctiveName, const String& sourceExpression) const |
| 1814 { | 1808 { |
| 1815 String message = "The Content Security Policy directive '" + directiveName +
"' contains '" + sourceExpression + "' as a source expression. Did you mean '"
+ directiveName + " ...; " + sourceExpression + "...' (note the semicolon)?"; | 1809 String message = "The Content Security Policy directive '" + directiveName +
"' contains '" + sourceExpression + "' as a source expression. Did you mean '"
+ directiveName + " ...; " + sourceExpression + "...' (note the semicolon)?"; |
| 1816 logToConsole(message); | 1810 logToConsole(message); |
| 1817 } | 1811 } |
| 1818 | 1812 |
| 1819 void ContentSecurityPolicy::reportDuplicateDirective(const String& name) const | 1813 void ContentSecurityPolicy::reportDuplicateDirective(const String& name) const |
| 1820 { | 1814 { |
| 1821 String message = makeString("Ignoring duplicate Content-Security-Policy dire
ctive '", name, "'.\n"); | 1815 String message = makeString("Ignoring duplicate Content-Security-Policy dire
ctive '", name, "'.\n"); |
| 1822 logToConsole(message); | 1816 logToConsole(message); |
| (...skipping 64 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 1887 { | 1881 { |
| 1888 InspectorInstrumentation::scriptExecutionBlockedByCSP(m_scriptExecutionConte
xt, directiveText); | 1882 InspectorInstrumentation::scriptExecutionBlockedByCSP(m_scriptExecutionConte
xt, directiveText); |
| 1889 } | 1883 } |
| 1890 | 1884 |
| 1891 bool ContentSecurityPolicy::experimentalFeaturesEnabled() const | 1885 bool ContentSecurityPolicy::experimentalFeaturesEnabled() const |
| 1892 { | 1886 { |
| 1893 return RuntimeEnabledFeatures::experimentalContentSecurityPolicyFeaturesEnab
led(); | 1887 return RuntimeEnabledFeatures::experimentalContentSecurityPolicyFeaturesEnab
led(); |
| 1894 } | 1888 } |
| 1895 | 1889 |
| 1896 } | 1890 } |
| OLD | NEW |