| Index: Source/core/page/ContentSecurityPolicy.cpp
|
| diff --git a/Source/core/page/ContentSecurityPolicy.cpp b/Source/core/page/ContentSecurityPolicy.cpp
|
| index f2b0b4e3ae5853d786a3fc3b3e11b2aea0479e7c..e03b6bb5ac4cb7edaaa2a06a594b7f1a0eb68894 100644
|
| --- a/Source/core/page/ContentSecurityPolicy.cpp
|
| +++ b/Source/core/page/ContentSecurityPolicy.cpp
|
| @@ -521,7 +521,7 @@ bool CSPSourceList::parseSource(const UChar* begin, const UChar* end,
|
| //
|
| bool CSPSourceList::parseNonce(const UChar* begin, const UChar* end, String& nonce)
|
| {
|
| - DEFINE_STATIC_LOCAL(const String, noncePrefix, (ASCIILiteral("'nonce-")));
|
| + DEFINE_STATIC_LOCAL(const String, noncePrefix, ("'nonce-"));
|
|
|
| if (!equalIgnoringCase(noncePrefix.characters8(), begin, noncePrefix.length()))
|
| return true;
|
| @@ -1048,7 +1048,7 @@ bool CSPDirectiveList::checkSourceAndReportViolation(SourceListDirective* direct
|
|
|
| bool CSPDirectiveList::allowJavaScriptURLs(const String& contextURL, const WTF::OrdinalNumber& contextLine, ContentSecurityPolicy::ReportingStatus reportingStatus) const
|
| {
|
| - DEFINE_STATIC_LOCAL(String, consoleMessage, (ASCIILiteral("Refused to execute JavaScript URL because it violates the following Content Security Policy directive: ")));
|
| + DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute JavaScript URL because it violates the following Content Security Policy directive: "));
|
| if (reportingStatus == ContentSecurityPolicy::SendReport) {
|
| return checkInlineAndReportViolation(operativeDirective(m_scriptSrc.get()), consoleMessage, contextURL, contextLine, true);
|
| } else {
|
| @@ -1058,7 +1058,7 @@ bool CSPDirectiveList::allowJavaScriptURLs(const String& contextURL, const WTF::
|
|
|
| bool CSPDirectiveList::allowInlineEventHandlers(const String& contextURL, const WTF::OrdinalNumber& contextLine, ContentSecurityPolicy::ReportingStatus reportingStatus) const
|
| {
|
| - DEFINE_STATIC_LOCAL(String, consoleMessage, (ASCIILiteral("Refused to execute inline event handler because it violates the following Content Security Policy directive: ")));
|
| + DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute inline event handler because it violates the following Content Security Policy directive: "));
|
| if (reportingStatus == ContentSecurityPolicy::SendReport) {
|
| return checkInlineAndReportViolation(operativeDirective(m_scriptSrc.get()), consoleMessage, contextURL, contextLine, true);
|
| } else {
|
| @@ -1068,7 +1068,7 @@ bool CSPDirectiveList::allowInlineEventHandlers(const String& contextURL, const
|
|
|
| bool CSPDirectiveList::allowInlineScript(const String& contextURL, const WTF::OrdinalNumber& contextLine, ContentSecurityPolicy::ReportingStatus reportingStatus) const
|
| {
|
| - DEFINE_STATIC_LOCAL(String, consoleMessage, (ASCIILiteral("Refused to execute inline script because it violates the following Content Security Policy directive: ")));
|
| + DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute inline script because it violates the following Content Security Policy directive: "));
|
| return reportingStatus == ContentSecurityPolicy::SendReport ?
|
| checkInlineAndReportViolation(operativeDirective(m_scriptSrc.get()), consoleMessage, contextURL, contextLine, true) :
|
| checkInline(operativeDirective(m_scriptSrc.get()));
|
| @@ -1076,7 +1076,7 @@ bool CSPDirectiveList::allowInlineScript(const String& contextURL, const WTF::Or
|
|
|
| bool CSPDirectiveList::allowInlineStyle(const String& contextURL, const WTF::OrdinalNumber& contextLine, ContentSecurityPolicy::ReportingStatus reportingStatus) const
|
| {
|
| - DEFINE_STATIC_LOCAL(String, consoleMessage, (ASCIILiteral("Refused to apply inline style because it violates the following Content Security Policy directive: ")));
|
| + DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to apply inline style because it violates the following Content Security Policy directive: "));
|
| return reportingStatus == ContentSecurityPolicy::SendReport ?
|
| checkInlineAndReportViolation(operativeDirective(m_styleSrc.get()), consoleMessage, contextURL, contextLine, false) :
|
| checkInline(operativeDirective(m_styleSrc.get()));
|
| @@ -1084,7 +1084,7 @@ bool CSPDirectiveList::allowInlineStyle(const String& contextURL, const WTF::Ord
|
|
|
| bool CSPDirectiveList::allowEval(ScriptState* state, ContentSecurityPolicy::ReportingStatus reportingStatus) const
|
| {
|
| - DEFINE_STATIC_LOCAL(String, consoleMessage, (ASCIILiteral("Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: ")));
|
| + DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "));
|
|
|
| return reportingStatus == ContentSecurityPolicy::SendReport ?
|
| checkEvalAndReportViolation(operativeDirective(m_scriptSrc.get()), consoleMessage, String(), WTF::OrdinalNumber::beforeFirst(), state) :
|
| @@ -1789,12 +1789,12 @@ void ContentSecurityPolicy::reportViolation(const String& directiveText, const S
|
|
|
| void ContentSecurityPolicy::reportUnsupportedDirective(const String& name) const
|
| {
|
| - DEFINE_STATIC_LOCAL(String, allow, (ASCIILiteral("allow")));
|
| - DEFINE_STATIC_LOCAL(String, options, (ASCIILiteral("options")));
|
| - DEFINE_STATIC_LOCAL(String, policyURI, (ASCIILiteral("policy-uri")));
|
| - DEFINE_STATIC_LOCAL(String, allowMessage, (ASCIILiteral("The 'allow' directive has been replaced with 'default-src'. Please use that directive instead, as 'allow' has no effect.")));
|
| - DEFINE_STATIC_LOCAL(String, optionsMessage, (ASCIILiteral("The 'options' directive has been replaced with 'unsafe-inline' and 'unsafe-eval' source expressions for the 'script-src' and 'style-src' directives. Please use those directives instead, as 'options' has no effect.")));
|
| - DEFINE_STATIC_LOCAL(String, policyURIMessage, (ASCIILiteral("The 'policy-uri' directive has been removed from the specification. Please specify a complete policy via the Content-Security-Policy header.")));
|
| + DEFINE_STATIC_LOCAL(String, allow, ("allow"));
|
| + DEFINE_STATIC_LOCAL(String, options, ("options"));
|
| + DEFINE_STATIC_LOCAL(String, policyURI, ("policy-uri"));
|
| + DEFINE_STATIC_LOCAL(String, allowMessage, ("The 'allow' directive has been replaced with 'default-src'. Please use that directive instead, as 'allow' has no effect."));
|
| + DEFINE_STATIC_LOCAL(String, optionsMessage, ("The 'options' directive has been replaced with 'unsafe-inline' and 'unsafe-eval' source expressions for the 'script-src' and 'style-src' directives. Please use those directives instead, as 'options' has no effect."));
|
| + DEFINE_STATIC_LOCAL(String, policyURIMessage, ("The 'policy-uri' directive has been removed from the specification. Please specify a complete policy via the Content-Security-Policy header."));
|
|
|
| String message = "Unrecognized Content-Security-Policy directive '" + name + "'.\n";
|
| if (equalIgnoringCase(name, allow))
|
|
|