OLD | NEW |
1 /* | 1 /* |
2 * Copyright (C) 2011 Google, Inc. All rights reserved. | 2 * Copyright (C) 2011 Google, Inc. All rights reserved. |
3 * | 3 * |
4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
5 * modification, are permitted provided that the following conditions | 5 * modification, are permitted provided that the following conditions |
6 * are met: | 6 * are met: |
7 * 1. Redistributions of source code must retain the above copyright | 7 * 1. Redistributions of source code must retain the above copyright |
8 * notice, this list of conditions and the following disclaimer. | 8 * notice, this list of conditions and the following disclaimer. |
9 * 2. Redistributions in binary form must reproduce the above copyright | 9 * 2. Redistributions in binary form must reproduce the above copyright |
10 * notice, this list of conditions and the following disclaimer in the | 10 * notice, this list of conditions and the following disclaimer in the |
(...skipping 503 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
514 } | 514 } |
515 | 515 |
516 return true; | 516 return true; |
517 } | 517 } |
518 | 518 |
519 // nonce-source = "'nonce-" nonce-value "'" | 519 // nonce-source = "'nonce-" nonce-value "'" |
520 // nonce-value = 1*( ALPHA / DIGIT / "+" / "/" ) | 520 // nonce-value = 1*( ALPHA / DIGIT / "+" / "/" ) |
521 // | 521 // |
522 bool CSPSourceList::parseNonce(const UChar* begin, const UChar* end, String& non
ce) | 522 bool CSPSourceList::parseNonce(const UChar* begin, const UChar* end, String& non
ce) |
523 { | 523 { |
524 DEFINE_STATIC_LOCAL(const String, noncePrefix, (ASCIILiteral("'nonce-"))); | 524 DEFINE_STATIC_LOCAL(const String, noncePrefix, ("'nonce-")); |
525 | 525 |
526 if (!equalIgnoringCase(noncePrefix.characters8(), begin, noncePrefix.length(
))) | 526 if (!equalIgnoringCase(noncePrefix.characters8(), begin, noncePrefix.length(
))) |
527 return true; | 527 return true; |
528 | 528 |
529 const UChar* position = begin + noncePrefix.length(); | 529 const UChar* position = begin + noncePrefix.length(); |
530 const UChar* nonceBegin = position; | 530 const UChar* nonceBegin = position; |
531 | 531 |
532 skipWhile<isNonceCharacter>(position, end); | 532 skipWhile<isNonceCharacter>(position, end); |
533 ASSERT(nonceBegin <= position); | 533 ASSERT(nonceBegin <= position); |
534 | 534 |
(...skipping 506 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1041 String suffix = String(); | 1041 String suffix = String(); |
1042 if (directive == m_defaultSrc) | 1042 if (directive == m_defaultSrc) |
1043 suffix = " Note that '" + effectiveDirective + "' was not explicitly set
, so 'default-src' is used as a fallback."; | 1043 suffix = " Note that '" + effectiveDirective + "' was not explicitly set
, so 'default-src' is used as a fallback."; |
1044 | 1044 |
1045 reportViolation(directive->text(), effectiveDirective, prefix + url.elidedSt
ring() + "' because it violates the following Content Security Policy directive:
\"" + directive->text() + "\"." + suffix + "\n", url); | 1045 reportViolation(directive->text(), effectiveDirective, prefix + url.elidedSt
ring() + "' because it violates the following Content Security Policy directive:
\"" + directive->text() + "\"." + suffix + "\n", url); |
1046 return denyIfEnforcingPolicy(); | 1046 return denyIfEnforcingPolicy(); |
1047 } | 1047 } |
1048 | 1048 |
1049 bool CSPDirectiveList::allowJavaScriptURLs(const String& contextURL, const WTF::
OrdinalNumber& contextLine, ContentSecurityPolicy::ReportingStatus reportingStat
us) const | 1049 bool CSPDirectiveList::allowJavaScriptURLs(const String& contextURL, const WTF::
OrdinalNumber& contextLine, ContentSecurityPolicy::ReportingStatus reportingStat
us) const |
1050 { | 1050 { |
1051 DEFINE_STATIC_LOCAL(String, consoleMessage, (ASCIILiteral("Refused to execut
e JavaScript URL because it violates the following Content Security Policy direc
tive: "))); | 1051 DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute JavaScript
URL because it violates the following Content Security Policy directive: ")); |
1052 if (reportingStatus == ContentSecurityPolicy::SendReport) { | 1052 if (reportingStatus == ContentSecurityPolicy::SendReport) { |
1053 return checkInlineAndReportViolation(operativeDirective(m_scriptSrc.get(
)), consoleMessage, contextURL, contextLine, true); | 1053 return checkInlineAndReportViolation(operativeDirective(m_scriptSrc.get(
)), consoleMessage, contextURL, contextLine, true); |
1054 } else { | 1054 } else { |
1055 return checkInline(operativeDirective(m_scriptSrc.get())); | 1055 return checkInline(operativeDirective(m_scriptSrc.get())); |
1056 } | 1056 } |
1057 } | 1057 } |
1058 | 1058 |
1059 bool CSPDirectiveList::allowInlineEventHandlers(const String& contextURL, const
WTF::OrdinalNumber& contextLine, ContentSecurityPolicy::ReportingStatus reportin
gStatus) const | 1059 bool CSPDirectiveList::allowInlineEventHandlers(const String& contextURL, const
WTF::OrdinalNumber& contextLine, ContentSecurityPolicy::ReportingStatus reportin
gStatus) const |
1060 { | 1060 { |
1061 DEFINE_STATIC_LOCAL(String, consoleMessage, (ASCIILiteral("Refused to execut
e inline event handler because it violates the following Content Security Policy
directive: "))); | 1061 DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute inline even
t handler because it violates the following Content Security Policy directive: "
)); |
1062 if (reportingStatus == ContentSecurityPolicy::SendReport) { | 1062 if (reportingStatus == ContentSecurityPolicy::SendReport) { |
1063 return checkInlineAndReportViolation(operativeDirective(m_scriptSrc.get(
)), consoleMessage, contextURL, contextLine, true); | 1063 return checkInlineAndReportViolation(operativeDirective(m_scriptSrc.get(
)), consoleMessage, contextURL, contextLine, true); |
1064 } else { | 1064 } else { |
1065 return checkInline(operativeDirective(m_scriptSrc.get())); | 1065 return checkInline(operativeDirective(m_scriptSrc.get())); |
1066 } | 1066 } |
1067 } | 1067 } |
1068 | 1068 |
1069 bool CSPDirectiveList::allowInlineScript(const String& contextURL, const WTF::Or
dinalNumber& contextLine, ContentSecurityPolicy::ReportingStatus reportingStatus
) const | 1069 bool CSPDirectiveList::allowInlineScript(const String& contextURL, const WTF::Or
dinalNumber& contextLine, ContentSecurityPolicy::ReportingStatus reportingStatus
) const |
1070 { | 1070 { |
1071 DEFINE_STATIC_LOCAL(String, consoleMessage, (ASCIILiteral("Refused to execut
e inline script because it violates the following Content Security Policy direct
ive: "))); | 1071 DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute inline scri
pt because it violates the following Content Security Policy directive: ")); |
1072 return reportingStatus == ContentSecurityPolicy::SendReport ? | 1072 return reportingStatus == ContentSecurityPolicy::SendReport ? |
1073 checkInlineAndReportViolation(operativeDirective(m_scriptSrc.get()), con
soleMessage, contextURL, contextLine, true) : | 1073 checkInlineAndReportViolation(operativeDirective(m_scriptSrc.get()), con
soleMessage, contextURL, contextLine, true) : |
1074 checkInline(operativeDirective(m_scriptSrc.get())); | 1074 checkInline(operativeDirective(m_scriptSrc.get())); |
1075 } | 1075 } |
1076 | 1076 |
1077 bool CSPDirectiveList::allowInlineStyle(const String& contextURL, const WTF::Ord
inalNumber& contextLine, ContentSecurityPolicy::ReportingStatus reportingStatus)
const | 1077 bool CSPDirectiveList::allowInlineStyle(const String& contextURL, const WTF::Ord
inalNumber& contextLine, ContentSecurityPolicy::ReportingStatus reportingStatus)
const |
1078 { | 1078 { |
1079 DEFINE_STATIC_LOCAL(String, consoleMessage, (ASCIILiteral("Refused to apply
inline style because it violates the following Content Security Policy directive
: "))); | 1079 DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to apply inline style
because it violates the following Content Security Policy directive: ")); |
1080 return reportingStatus == ContentSecurityPolicy::SendReport ? | 1080 return reportingStatus == ContentSecurityPolicy::SendReport ? |
1081 checkInlineAndReportViolation(operativeDirective(m_styleSrc.get()), cons
oleMessage, contextURL, contextLine, false) : | 1081 checkInlineAndReportViolation(operativeDirective(m_styleSrc.get()), cons
oleMessage, contextURL, contextLine, false) : |
1082 checkInline(operativeDirective(m_styleSrc.get())); | 1082 checkInline(operativeDirective(m_styleSrc.get())); |
1083 } | 1083 } |
1084 | 1084 |
1085 bool CSPDirectiveList::allowEval(ScriptState* state, ContentSecurityPolicy::Repo
rtingStatus reportingStatus) const | 1085 bool CSPDirectiveList::allowEval(ScriptState* state, ContentSecurityPolicy::Repo
rtingStatus reportingStatus) const |
1086 { | 1086 { |
1087 DEFINE_STATIC_LOCAL(String, consoleMessage, (ASCIILiteral("Refused to evalua
te a string as JavaScript because 'unsafe-eval' is not an allowed source of scri
pt in the following Content Security Policy directive: "))); | 1087 DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to evaluate a string a
s JavaScript because 'unsafe-eval' is not an allowed source of script in the fol
lowing Content Security Policy directive: ")); |
1088 | 1088 |
1089 return reportingStatus == ContentSecurityPolicy::SendReport ? | 1089 return reportingStatus == ContentSecurityPolicy::SendReport ? |
1090 checkEvalAndReportViolation(operativeDirective(m_scriptSrc.get()), conso
leMessage, String(), WTF::OrdinalNumber::beforeFirst(), state) : | 1090 checkEvalAndReportViolation(operativeDirective(m_scriptSrc.get()), conso
leMessage, String(), WTF::OrdinalNumber::beforeFirst(), state) : |
1091 checkEval(operativeDirective(m_scriptSrc.get())); | 1091 checkEval(operativeDirective(m_scriptSrc.get())); |
1092 } | 1092 } |
1093 | 1093 |
1094 bool CSPDirectiveList::allowPluginType(const String& type, const String& typeAtt
ribute, const KURL& url, ContentSecurityPolicy::ReportingStatus reportingStatus)
const | 1094 bool CSPDirectiveList::allowPluginType(const String& type, const String& typeAtt
ribute, const KURL& url, ContentSecurityPolicy::ReportingStatus reportingStatus)
const |
1095 { | 1095 { |
1096 return reportingStatus == ContentSecurityPolicy::SendReport ? | 1096 return reportingStatus == ContentSecurityPolicy::SendReport ? |
1097 checkMediaTypeAndReportViolation(m_pluginTypes.get(), type, typeAttribut
e, "Refused to load '" + url.elidedString() + "' (MIME type '" + typeAttribute +
"') because it violates the following Content Security Policy Directive: ") : | 1097 checkMediaTypeAndReportViolation(m_pluginTypes.get(), type, typeAttribut
e, "Refused to load '" + url.elidedString() + "' (MIME type '" + typeAttribute +
"') because it violates the following Content Security Policy Directive: ") : |
(...skipping 684 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1782 RefPtr<FormData> report = FormData::create(stringifiedReport.utf8()); | 1782 RefPtr<FormData> report = FormData::create(stringifiedReport.utf8()); |
1783 | 1783 |
1784 for (size_t i = 0; i < reportURIs.size(); ++i) | 1784 for (size_t i = 0; i < reportURIs.size(); ++i) |
1785 PingLoader::sendViolationReport(frame, reportURIs[i], report, PingLoader
::ContentSecurityPolicyViolationReport); | 1785 PingLoader::sendViolationReport(frame, reportURIs[i], report, PingLoader
::ContentSecurityPolicyViolationReport); |
1786 | 1786 |
1787 didSendViolationReport(stringifiedReport); | 1787 didSendViolationReport(stringifiedReport); |
1788 } | 1788 } |
1789 | 1789 |
1790 void ContentSecurityPolicy::reportUnsupportedDirective(const String& name) const | 1790 void ContentSecurityPolicy::reportUnsupportedDirective(const String& name) const |
1791 { | 1791 { |
1792 DEFINE_STATIC_LOCAL(String, allow, (ASCIILiteral("allow"))); | 1792 DEFINE_STATIC_LOCAL(String, allow, ("allow")); |
1793 DEFINE_STATIC_LOCAL(String, options, (ASCIILiteral("options"))); | 1793 DEFINE_STATIC_LOCAL(String, options, ("options")); |
1794 DEFINE_STATIC_LOCAL(String, policyURI, (ASCIILiteral("policy-uri"))); | 1794 DEFINE_STATIC_LOCAL(String, policyURI, ("policy-uri")); |
1795 DEFINE_STATIC_LOCAL(String, allowMessage, (ASCIILiteral("The 'allow' directi
ve has been replaced with 'default-src'. Please use that directive instead, as '
allow' has no effect."))); | 1795 DEFINE_STATIC_LOCAL(String, allowMessage, ("The 'allow' directive has been r
eplaced with 'default-src'. Please use that directive instead, as 'allow' has no
effect.")); |
1796 DEFINE_STATIC_LOCAL(String, optionsMessage, (ASCIILiteral("The 'options' dir
ective has been replaced with 'unsafe-inline' and 'unsafe-eval' source expressio
ns for the 'script-src' and 'style-src' directives. Please use those directives
instead, as 'options' has no effect."))); | 1796 DEFINE_STATIC_LOCAL(String, optionsMessage, ("The 'options' directive has be
en replaced with 'unsafe-inline' and 'unsafe-eval' source expressions for the 's
cript-src' and 'style-src' directives. Please use those directives instead, as '
options' has no effect.")); |
1797 DEFINE_STATIC_LOCAL(String, policyURIMessage, (ASCIILiteral("The 'policy-uri
' directive has been removed from the specification. Please specify a complete p
olicy via the Content-Security-Policy header."))); | 1797 DEFINE_STATIC_LOCAL(String, policyURIMessage, ("The 'policy-uri' directive h
as been removed from the specification. Please specify a complete policy via the
Content-Security-Policy header.")); |
1798 | 1798 |
1799 String message = "Unrecognized Content-Security-Policy directive '" + name +
"'.\n"; | 1799 String message = "Unrecognized Content-Security-Policy directive '" + name +
"'.\n"; |
1800 if (equalIgnoringCase(name, allow)) | 1800 if (equalIgnoringCase(name, allow)) |
1801 message = allowMessage; | 1801 message = allowMessage; |
1802 else if (equalIgnoringCase(name, options)) | 1802 else if (equalIgnoringCase(name, options)) |
1803 message = optionsMessage; | 1803 message = optionsMessage; |
1804 else if (equalIgnoringCase(name, policyURI)) | 1804 else if (equalIgnoringCase(name, policyURI)) |
1805 message = policyURIMessage; | 1805 message = policyURIMessage; |
1806 | 1806 |
1807 logToConsole(message); | 1807 logToConsole(message); |
(...skipping 97 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1905 // Collisions have no security impact, so we can save space by storing only
the string's hash rather than the whole report. | 1905 // Collisions have no security impact, so we can save space by storing only
the string's hash rather than the whole report. |
1906 return !m_violationReportsSent.contains(report.impl()->hash()); | 1906 return !m_violationReportsSent.contains(report.impl()->hash()); |
1907 } | 1907 } |
1908 | 1908 |
1909 void ContentSecurityPolicy::didSendViolationReport(const String& report) | 1909 void ContentSecurityPolicy::didSendViolationReport(const String& report) |
1910 { | 1910 { |
1911 m_violationReportsSent.add(report.impl()->hash()); | 1911 m_violationReportsSent.add(report.impl()->hash()); |
1912 } | 1912 } |
1913 | 1913 |
1914 } // namespace WebCore | 1914 } // namespace WebCore |
OLD | NEW |