DOMSecurityPolicy.cpp [plain text]
#include "config.h"
#include "DOMSecurityPolicy.h"
#include "ContentSecurityPolicy.h"
#include "ContextDestructionObserver.h"
#include "DOMStringList.h"
#include "Frame.h"
#include "ScriptCallStack.h"
#include "ScriptExecutionContext.h"
#include <wtf/text/TextPosition.h>
#include <wtf/text/WTFString.h>
namespace WebCore {
namespace {
bool isPolicyActiveInContext(ScriptExecutionContext* context)
{
if (!context)
return false;
return context->contentSecurityPolicy()->isActive();
}
template<bool (ContentSecurityPolicy::*allowWithType)(const String&, const String&, const KURL&, ContentSecurityPolicy::ReportingStatus) const>
bool isAllowedWithType(ScriptExecutionContext* context, const String& type)
{
if (!isPolicyActiveInContext(context))
return true;
return (context->contentSecurityPolicy()->*allowWithType)(type, type, KURL(), ContentSecurityPolicy::SuppressReport);
}
template<bool (ContentSecurityPolicy::*allowWithURL)(const KURL&, ContentSecurityPolicy::ReportingStatus) const>
bool isAllowedWithURL(ScriptExecutionContext* context, const String& url)
{
if (!isPolicyActiveInContext(context))
return true;
KURL parsedURL = context->completeURL(url);
if (!parsedURL.isValid())
return false;
return (context->contentSecurityPolicy()->*allowWithURL)(parsedURL, ContentSecurityPolicy::SuppressReport);
}
template<bool (ContentSecurityPolicy::*allowWithContext)(const String&, const WTF::OrdinalNumber&, ContentSecurityPolicy::ReportingStatus) const>
bool isAllowed(ScriptExecutionContext* context)
{
if (!isPolicyActiveInContext(context))
return true;
return (context->contentSecurityPolicy()->*allowWithContext)(String(), WTF::OrdinalNumber::beforeFirst(), ContentSecurityPolicy::SuppressReport);
}
}
DOMSecurityPolicy::DOMSecurityPolicy(ScriptExecutionContext* context)
: ContextDestructionObserver(context)
{
}
DOMSecurityPolicy::~DOMSecurityPolicy()
{
}
bool DOMSecurityPolicy::isActive() const
{
return isPolicyActiveInContext(scriptExecutionContext());
}
PassRefPtr<DOMStringList> DOMSecurityPolicy::reportURIs() const
{
RefPtr<DOMStringList> result = DOMStringList::create();
if (isActive())
scriptExecutionContext()->contentSecurityPolicy()->gatherReportURIs(*result.get());
return result.release();
}
bool DOMSecurityPolicy::allowsInlineScript() const
{
return isAllowed<&ContentSecurityPolicy::allowInlineScript>(scriptExecutionContext());
}
bool DOMSecurityPolicy::allowsInlineStyle() const
{
return isAllowed<&ContentSecurityPolicy::allowInlineStyle>(scriptExecutionContext());
}
bool DOMSecurityPolicy::allowsEval() const
{
if (!isActive())
return true;
return scriptExecutionContext()->contentSecurityPolicy()->allowEval(0, ContentSecurityPolicy::SuppressReport);
}
bool DOMSecurityPolicy::allowsConnectionTo(const String& url) const
{
return isAllowedWithURL<&ContentSecurityPolicy::allowConnectToSource>(scriptExecutionContext(), url);
}
bool DOMSecurityPolicy::allowsFontFrom(const String& url) const
{
return isAllowedWithURL<&ContentSecurityPolicy::allowFontFromSource>(scriptExecutionContext(), url);
}
bool DOMSecurityPolicy::allowsFormAction(const String& url) const
{
return isAllowedWithURL<&ContentSecurityPolicy::allowFormAction>(scriptExecutionContext(), url);
}
bool DOMSecurityPolicy::allowsFrameFrom(const String& url) const
{
return isAllowedWithURL<&ContentSecurityPolicy::allowChildFrameFromSource>(scriptExecutionContext(), url);
}
bool DOMSecurityPolicy::allowsImageFrom(const String& url) const
{
return isAllowedWithURL<&ContentSecurityPolicy::allowImageFromSource>(scriptExecutionContext(), url);
}
bool DOMSecurityPolicy::allowsMediaFrom(const String& url) const
{
return isAllowedWithURL<&ContentSecurityPolicy::allowMediaFromSource>(scriptExecutionContext(), url);
}
bool DOMSecurityPolicy::allowsObjectFrom(const String& url) const
{
return isAllowedWithURL<&ContentSecurityPolicy::allowObjectFromSource>(scriptExecutionContext(), url);
}
bool DOMSecurityPolicy::allowsPluginType(const String& type) const
{
return isAllowedWithType<&ContentSecurityPolicy::allowPluginType>(scriptExecutionContext(), type);
}
bool DOMSecurityPolicy::allowsScriptFrom(const String& url) const
{
return isAllowedWithURL<&ContentSecurityPolicy::allowScriptFromSource>(scriptExecutionContext(), url);
}
bool DOMSecurityPolicy::allowsStyleFrom(const String& url) const
{
return isAllowedWithURL<&ContentSecurityPolicy::allowStyleFromSource>(scriptExecutionContext(), url);
}
}