OLD | NEW |
---|---|
1 // Copyright 2014 The Chromium Authors. All rights reserved. | 1 // Copyright 2014 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "config.h" | 5 #include "config.h" |
6 #include "core/frame/csp/CSPDirectiveList.h" | 6 #include "core/frame/csp/CSPDirectiveList.h" |
7 | 7 |
8 #include "bindings/core/v8/ScriptCallStackFactory.h" | |
8 #include "core/dom/Document.h" | 9 #include "core/dom/Document.h" |
9 #include "core/frame/LocalFrame.h" | 10 #include "core/frame/LocalFrame.h" |
10 #include "platform/ParsingUtilities.h" | 11 #include "platform/ParsingUtilities.h" |
11 #include "platform/weborigin/KURL.h" | 12 #include "platform/weborigin/KURL.h" |
12 #include "wtf/text/WTFString.h" | 13 #include "wtf/text/WTFString.h" |
13 | 14 |
14 namespace WebCore { | 15 namespace WebCore { |
15 | 16 |
16 CSPDirectiveList::CSPDirectiveList(ContentSecurityPolicy* policy, ContentSecurit yPolicyHeaderType type, ContentSecurityPolicyHeaderSource source) | 17 CSPDirectiveList::CSPDirectiveList(ContentSecurityPolicy* policy, ContentSecurit yPolicyHeaderType type, ContentSecurityPolicyHeaderSource source) |
17 : m_policy(policy) | 18 : m_policy(policy) |
(...skipping 31 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
49 m_policy->reportViolation(directiveText, effectiveDirective, message, blocke dURL, m_reportURIs, m_header); | 50 m_policy->reportViolation(directiveText, effectiveDirective, message, blocke dURL, m_reportURIs, m_header); |
50 } | 51 } |
51 | 52 |
52 void CSPDirectiveList::reportViolationWithLocation(const String& directiveText, const String& effectiveDirective, const String& consoleMessage, const KURL& bloc kedURL, const String& contextURL, const WTF::OrdinalNumber& contextLine) const | 53 void CSPDirectiveList::reportViolationWithLocation(const String& directiveText, const String& effectiveDirective, const String& consoleMessage, const KURL& bloc kedURL, const String& contextURL, const WTF::OrdinalNumber& contextLine) const |
53 { | 54 { |
54 String message = m_reportOnly ? "[Report Only] " + consoleMessage : consoleM essage; | 55 String message = m_reportOnly ? "[Report Only] " + consoleMessage : consoleM essage; |
55 m_policy->executionContext()->addConsoleMessage(SecurityMessageSource, Error MessageLevel, message, contextURL, contextLine.oneBasedInt()); | 56 m_policy->executionContext()->addConsoleMessage(SecurityMessageSource, Error MessageLevel, message, contextURL, contextLine.oneBasedInt()); |
56 m_policy->reportViolation(directiveText, effectiveDirective, message, blocke dURL, m_reportURIs, m_header); | 57 m_policy->reportViolation(directiveText, effectiveDirective, message, blocke dURL, m_reportURIs, m_header); |
57 } | 58 } |
58 | 59 |
59 void CSPDirectiveList::reportViolationWithState(const String& directiveText, con st String& effectiveDirective, const String& consoleMessage, const KURL& blocked URL, ScriptState* scriptState) const | 60 void CSPDirectiveList::reportViolationWithStack(const String& directiveText, con st String& effectiveDirective, const String& consoleMessage, const KURL& blocked URL, PassRefPtr<ScriptCallStack> callStack) const |
60 { | 61 { |
61 String message = m_reportOnly ? "[Report Only] " + consoleMessage : consoleM essage; | 62 String message = m_reportOnly ? "[Report Only] " + consoleMessage : consoleM essage; |
62 m_policy->executionContext()->addConsoleMessage(SecurityMessageSource, Error MessageLevel, message, scriptState); | 63 m_policy->executionContext()->addConsoleMessage(SecurityMessageSource, Error MessageLevel, message, callStack); |
63 m_policy->reportViolation(directiveText, effectiveDirective, message, blocke dURL, m_reportURIs, m_header); | 64 m_policy->reportViolation(directiveText, effectiveDirective, message, blocke dURL, m_reportURIs, m_header); |
64 } | 65 } |
65 | 66 |
66 bool CSPDirectiveList::checkEval(SourceListDirective* directive) const | 67 bool CSPDirectiveList::checkEval(SourceListDirective* directive) const |
67 { | 68 { |
68 return !directive || directive->allowEval(); | 69 return !directive || directive->allowEval(); |
69 } | 70 } |
70 | 71 |
71 bool CSPDirectiveList::checkInline(SourceListDirective* directive) const | 72 bool CSPDirectiveList::checkInline(SourceListDirective* directive) const |
72 { | 73 { |
(...skipping 49 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
122 | 123 |
123 bool CSPDirectiveList::checkEvalAndReportViolation(SourceListDirective* directiv e, const String& consoleMessage, ScriptState* scriptState) const | 124 bool CSPDirectiveList::checkEvalAndReportViolation(SourceListDirective* directiv e, const String& consoleMessage, ScriptState* scriptState) const |
124 { | 125 { |
125 if (checkEval(directive)) | 126 if (checkEval(directive)) |
126 return true; | 127 return true; |
127 | 128 |
128 String suffix = String(); | 129 String suffix = String(); |
129 if (directive == m_defaultSrc) | 130 if (directive == m_defaultSrc) |
130 suffix = " Note that 'script-src' was not explicitly set, so 'default-sr c' is used as a fallback."; | 131 suffix = " Note that 'script-src' was not explicitly set, so 'default-sr c' is used as a fallback."; |
131 | 132 |
132 reportViolationWithState(directive->text(), ContentSecurityPolicy::ScriptSrc , consoleMessage + "\"" + directive->text() + "\"." + suffix + "\n", KURL(), scr iptState); | 133 RefPtr<ScriptCallStack> callStack; |
134 if (scriptState) | |
vsevik
2014/07/15 14:40:33
Let's extract this to a separate change
| |
135 callStack = createScriptCallStackForConsole(scriptState); | |
136 | |
137 reportViolationWithStack(directive->text(), ContentSecurityPolicy::ScriptSrc , consoleMessage + "\"" + directive->text() + "\"." + suffix + "\n", KURL(), cal lStack.release()); | |
138 | |
133 if (!m_reportOnly) { | 139 if (!m_reportOnly) { |
134 m_policy->reportBlockedScriptExecutionToInspector(directive->text()); | 140 m_policy->reportBlockedScriptExecutionToInspector(directive->text()); |
135 return false; | 141 return false; |
136 } | 142 } |
137 return true; | 143 return true; |
138 } | 144 } |
139 | 145 |
140 bool CSPDirectiveList::checkMediaTypeAndReportViolation(MediaListDirective* dire ctive, const String& type, const String& typeAttribute, const String& consoleMes sage) const | 146 bool CSPDirectiveList::checkMediaTypeAndReportViolation(MediaListDirective* dire ctive, const String& type, const String& typeAttribute, const String& consoleMes sage) const |
141 { | 147 { |
142 if (checkMediaType(directive, type, typeAttribute)) | 148 if (checkMediaType(directive, type, typeAttribute)) |
(...skipping 528 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
671 parseReferrer(name, value); | 677 parseReferrer(name, value); |
672 else | 678 else |
673 m_policy->reportUnsupportedDirective(name); | 679 m_policy->reportUnsupportedDirective(name); |
674 } else { | 680 } else { |
675 m_policy->reportUnsupportedDirective(name); | 681 m_policy->reportUnsupportedDirective(name); |
676 } | 682 } |
677 } | 683 } |
678 | 684 |
679 | 685 |
680 } // namespace WebCore | 686 } // namespace WebCore |
OLD | NEW |