- Revision
- 144571
- Author
- [email protected]
- Date
- 2013-03-03 03:06:19 -0800 (Sun, 03 Mar 2013)
Log Message
CSP 1.1: Support CSP 1.1 directives on the unprefixed header.
https://bugs.webkit.org/show_bug.cgi?id=111254
Reviewed by Adam Barth.
Source/WebCore:
We'd like to ensure that early adopters don't get stuck on a prefixed
header; when CSP 1.1 is baked enough to be supported in multiple
browsers, everything should Just Work™.
This patch changes WebKit's behavior regarding CSP_NEXT features.
Currently, they're only exposed on the prefixed header ('X-WebKit-CSP').
This patch exposes those features on the canonical header, assuming
that the runtime flag is set. This shouldn't have any effect at all on
ports that haven't yet enabled CSP_NEXT, and will simply clear the way
for a clean deployment to a wider audience once the specification
process is further along.
This change shouldn't have any effect on the existing tests: they
should run just as they did before. The next step will be to adjust
the LayoutTests for 1.1 to prefer the canonical header, but I'll do
that in another patch to reduce churn.
Related, the enum names no longer made sense: the difference between the
canonical 'Content-Security-Policy' header and 'X-WebKit-CSP' is the
prefix, not the functionality. This patch renames them for clarity.
* dom/Document.cpp:
(WebCore::Document::processHttpEquiv):
* loader/FrameLoader.cpp:
(WebCore::FrameLoader::didBeginDocument):
Use the new enum names.
* page/ContentSecurityPolicy.cpp:
(CSPDirectiveList):
(WebCore::CSPDirectiveList::CSPDirectiveList):
(WebCore::CSPDirectiveList::addDirective):
Drop the 'm_experimental' property from CSPDirectiveList; we'll
control the behavior via the runtime flag from now on.
Also, this fixes a small bug in 'addDirective()': we never threw
unrecognized directive errors for users who were sending the
prefixed header. Oops!
(WebCore::ContentSecurityPolicy::deprecatedHeaderType):
Use the new enum names.
* page/ContentSecurityPolicy.h:
Redefine the enum for clarity: 'PrefixedReport' and 'Report'
rather than 'ReportAllDirectives' and 'ReportStableDirectives'.
Source/WebKit/chromium:
The enum names no longer made sense: the difference between the
canonical 'Content-Security-Policy' header and 'X-WebKit-CSP' is the
prefix, not the functionality. This patch renames them for clarity.
* public/WebContentSecurityPolicy.h:
* src/AssertMatchingEnums.cpp:
Rename the Chromium side of the enums.
Modified Paths
Diff
Modified: trunk/Source/WebCore/ChangeLog (144570 => 144571)
--- trunk/Source/WebCore/ChangeLog 2013-03-03 10:47:41 UTC (rev 144570)
+++ trunk/Source/WebCore/ChangeLog 2013-03-03 11:06:19 UTC (rev 144571)
@@ -1,3 +1,52 @@
+2013-03-03 Mike West <[email protected]>
+
+ CSP 1.1: Support CSP 1.1 directives on the unprefixed header.
+ https://bugs.webkit.org/show_bug.cgi?id=111254
+
+ Reviewed by Adam Barth.
+
+ We'd like to ensure that early adopters don't get stuck on a prefixed
+ header; when CSP 1.1 is baked enough to be supported in multiple
+ browsers, everything should Just Work™.
+
+ This patch changes WebKit's behavior regarding CSP_NEXT features.
+ Currently, they're only exposed on the prefixed header ('X-WebKit-CSP').
+ This patch exposes those features on the canonical header, assuming
+ that the runtime flag is set. This shouldn't have any effect at all on
+ ports that haven't yet enabled CSP_NEXT, and will simply clear the way
+ for a clean deployment to a wider audience once the specification
+ process is further along.
+
+ This change shouldn't have any effect on the existing tests: they
+ should run just as they did before. The next step will be to adjust
+ the LayoutTests for 1.1 to prefer the canonical header, but I'll do
+ that in another patch to reduce churn.
+
+ Related, the enum names no longer made sense: the difference between the
+ canonical 'Content-Security-Policy' header and 'X-WebKit-CSP' is the
+ prefix, not the functionality. This patch renames them for clarity.
+
+ * dom/Document.cpp:
+ (WebCore::Document::processHttpEquiv):
+ * loader/FrameLoader.cpp:
+ (WebCore::FrameLoader::didBeginDocument):
+ Use the new enum names.
+ * page/ContentSecurityPolicy.cpp:
+ (CSPDirectiveList):
+ (WebCore::CSPDirectiveList::CSPDirectiveList):
+ (WebCore::CSPDirectiveList::addDirective):
+ Drop the 'm_experimental' property from CSPDirectiveList; we'll
+ control the behavior via the runtime flag from now on.
+
+ Also, this fixes a small bug in 'addDirective()': we never threw
+ unrecognized directive errors for users who were sending the
+ prefixed header. Oops!
+ (WebCore::ContentSecurityPolicy::deprecatedHeaderType):
+ Use the new enum names.
+ * page/ContentSecurityPolicy.h:
+ Redefine the enum for clarity: 'PrefixedReport' and 'Report'
+ rather than 'ReportAllDirectives' and 'ReportStableDirectives'.
+
2013-03-03 Ryosuke Niwa <[email protected]>
Another Windows build fix attempt after r144567.
Modified: trunk/Source/WebCore/dom/Document.cpp (144570 => 144571)
--- trunk/Source/WebCore/dom/Document.cpp 2013-03-03 10:47:41 UTC (rev 144570)
+++ trunk/Source/WebCore/dom/Document.cpp 2013-03-03 11:06:19 UTC (rev 144571)
@@ -2900,13 +2900,13 @@
}
}
} else if (equalIgnoringCase(equiv, "content-security-policy"))
- contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicy::EnforceStableDirectives);
+ contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicy::Enforce);
else if (equalIgnoringCase(equiv, "content-security-policy-report-only"))
- contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicy::ReportStableDirectives);
+ contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicy::Report);
else if (equalIgnoringCase(equiv, "x-webkit-csp"))
- contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicy::EnforceAllDirectives);
+ contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicy::PrefixedEnforce);
else if (equalIgnoringCase(equiv, "x-webkit-csp-report-only"))
- contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicy::ReportAllDirectives);
+ contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicy::PrefixedReport);
}
// Though isspace() considers \t and \v to be whitespace, Win IE doesn't.
Modified: trunk/Source/WebCore/loader/FrameLoader.cpp (144570 => 144571)
--- trunk/Source/WebCore/loader/FrameLoader.cpp 2013-03-03 10:47:41 UTC (rev 144570)
+++ trunk/Source/WebCore/loader/FrameLoader.cpp 2013-03-03 11:06:19 UTC (rev 144571)
@@ -658,19 +658,19 @@
String policyValue = m_documentLoader->response().httpHeaderField("Content-Security-Policy");
if (!policyValue.isEmpty())
- m_frame->document()->contentSecurityPolicy()->didReceiveHeader(policyValue, ContentSecurityPolicy::EnforceStableDirectives);
+ m_frame->document()->contentSecurityPolicy()->didReceiveHeader(policyValue, ContentSecurityPolicy::Enforce);
policyValue = m_documentLoader->response().httpHeaderField("Content-Security-Policy-Report-Only");
if (!policyValue.isEmpty())
- m_frame->document()->contentSecurityPolicy()->didReceiveHeader(policyValue, ContentSecurityPolicy::ReportStableDirectives);
+ m_frame->document()->contentSecurityPolicy()->didReceiveHeader(policyValue, ContentSecurityPolicy::Report);
policyValue = m_documentLoader->response().httpHeaderField("X-WebKit-CSP");
if (!policyValue.isEmpty())
- m_frame->document()->contentSecurityPolicy()->didReceiveHeader(policyValue, ContentSecurityPolicy::EnforceAllDirectives);
+ m_frame->document()->contentSecurityPolicy()->didReceiveHeader(policyValue, ContentSecurityPolicy::PrefixedEnforce);
policyValue = m_documentLoader->response().httpHeaderField("X-WebKit-CSP-Report-Only");
if (!policyValue.isEmpty())
- m_frame->document()->contentSecurityPolicy()->didReceiveHeader(policyValue, ContentSecurityPolicy::ReportAllDirectives);
+ m_frame->document()->contentSecurityPolicy()->didReceiveHeader(policyValue, ContentSecurityPolicy::PrefixedReport);
String headerContentLanguage = m_documentLoader->response().httpHeaderField("Content-Language");
if (!headerContentLanguage.isEmpty()) {
Modified: trunk/Source/WebCore/page/ContentSecurityPolicy.cpp (144570 => 144571)
--- trunk/Source/WebCore/page/ContentSecurityPolicy.cpp 2013-03-03 10:47:41 UTC (rev 144570)
+++ trunk/Source/WebCore/page/ContentSecurityPolicy.cpp 2013-03-03 11:06:19 UTC (rev 144571)
@@ -148,13 +148,13 @@
FeatureObserver::Feature getFeatureObserverType(ContentSecurityPolicy::HeaderType type)
{
switch (type) {
- case ContentSecurityPolicy::EnforceAllDirectives:
+ case ContentSecurityPolicy::PrefixedEnforce:
return FeatureObserver::PrefixedContentSecurityPolicy;
- case ContentSecurityPolicy::EnforceStableDirectives:
+ case ContentSecurityPolicy::Enforce:
return FeatureObserver::ContentSecurityPolicy;
- case ContentSecurityPolicy::ReportAllDirectives:
+ case ContentSecurityPolicy::PrefixedReport:
return FeatureObserver::PrefixedContentSecurityPolicyReportOnly;
- case ContentSecurityPolicy::ReportStableDirectives:
+ case ContentSecurityPolicy::Report:
return FeatureObserver::ContentSecurityPolicyReportOnly;
}
ASSERT_NOT_REACHED();
@@ -886,7 +886,6 @@
String m_header;
ContentSecurityPolicy::HeaderType m_headerType;
- bool m_experimental;
bool m_reportOnly;
bool m_haveSandboxPolicy;
ContentSecurityPolicy::ReflectedXSSDisposition m_reflectedXSSDisposition;
@@ -912,13 +911,11 @@
CSPDirectiveList::CSPDirectiveList(ContentSecurityPolicy* policy, ContentSecurityPolicy::HeaderType type)
: m_policy(policy)
, m_headerType(type)
- , m_experimental(false)
, m_reportOnly(false)
, m_haveSandboxPolicy(false)
, m_reflectedXSSDisposition(ContentSecurityPolicy::ReflectedXSSUnset)
{
- m_reportOnly = (type == ContentSecurityPolicy::ReportStableDirectives || type == ContentSecurityPolicy::ReportAllDirectives);
- m_experimental = (type == ContentSecurityPolicy::ReportAllDirectives || type == ContentSecurityPolicy::EnforceAllDirectives);
+ m_reportOnly = (type == ContentSecurityPolicy::Report || type == ContentSecurityPolicy::PrefixedReport);
}
PassOwnPtr<CSPDirectiveList> CSPDirectiveList::create(ContentSecurityPolicy* policy, const String& header, ContentSecurityPolicy::HeaderType type)
@@ -1398,7 +1395,7 @@
else if (equalIgnoringCase(name, reportURI))
parseReportURI(name, value);
#if ENABLE(CSP_NEXT)
- else if (m_experimental && m_policy->experimentalFeaturesEnabled()) {
+ else if (m_policy->experimentalFeaturesEnabled()) {
if (equalIgnoringCase(name, formAction))
setCSPDirective<SourceListDirective>(name, value, m_formAction);
else if (equalIgnoringCase(name, pluginTypes))
@@ -1407,6 +1404,8 @@
setCSPDirective<NonceDirective>(name, value, m_scriptNonce);
else if (equalIgnoringCase(name, reflectedXSS))
parseReflectedXSS(name, value);
+ else
+ m_policy->reportUnsupportedDirective(name);
}
#endif
else
@@ -1473,7 +1472,7 @@
ContentSecurityPolicy::HeaderType ContentSecurityPolicy::deprecatedHeaderType() const
{
- return m_policies.isEmpty() ? EnforceStableDirectives : m_policies[0]->headerType();
+ return m_policies.isEmpty() ? Enforce : m_policies[0]->headerType();
}
template<bool (CSPDirectiveList::*allowed)(ContentSecurityPolicy::ReportingStatus) const>
Modified: trunk/Source/WebCore/page/ContentSecurityPolicy.h (144570 => 144571)
--- trunk/Source/WebCore/page/ContentSecurityPolicy.h 2013-03-03 10:47:41 UTC (rev 144570)
+++ trunk/Source/WebCore/page/ContentSecurityPolicy.h 2013-03-03 11:06:19 UTC (rev 144571)
@@ -60,10 +60,10 @@
void copyStateFrom(const ContentSecurityPolicy*);
enum HeaderType {
- ReportStableDirectives,
- EnforceStableDirectives,
- ReportAllDirectives,
- EnforceAllDirectives
+ Report,
+ Enforce,
+ PrefixedReport,
+ PrefixedEnforce
};
enum ReportingStatus {
Modified: trunk/Source/WebKit/chromium/ChangeLog (144570 => 144571)
--- trunk/Source/WebKit/chromium/ChangeLog 2013-03-03 10:47:41 UTC (rev 144570)
+++ trunk/Source/WebKit/chromium/ChangeLog 2013-03-03 11:06:19 UTC (rev 144571)
@@ -1,3 +1,18 @@
+2013-03-03 Mike West <[email protected]>
+
+ CSP 1.1: Support CSP 1.1 directives on the unprefixed header.
+ https://bugs.webkit.org/show_bug.cgi?id=111254
+
+ Reviewed by Adam Barth.
+
+ The enum names no longer made sense: the difference between the
+ canonical 'Content-Security-Policy' header and 'X-WebKit-CSP' is the
+ prefix, not the functionality. This patch renames them for clarity.
+
+ * public/WebContentSecurityPolicy.h:
+ * src/AssertMatchingEnums.cpp:
+ Rename the Chromium side of the enums.
+
2013-03-03 Adam Barth <[email protected]>
Unreviewed attempted build fix. Adds back some includes removed in
Modified: trunk/Source/WebKit/chromium/public/WebContentSecurityPolicy.h (144570 => 144571)
--- trunk/Source/WebKit/chromium/public/WebContentSecurityPolicy.h 2013-03-03 10:47:41 UTC (rev 144570)
+++ trunk/Source/WebKit/chromium/public/WebContentSecurityPolicy.h 2013-03-03 11:06:19 UTC (rev 144571)
@@ -34,10 +34,10 @@
namespace WebKit {
enum WebContentSecurityPolicyType {
- WebContentSecurityPolicyTypeReportStableDirectives,
- WebContentSecurityPolicyTypeEnforceStableDirectives,
- WebContentSecurityPolicyTypeReportAllDirectives,
- WebContentSecurityPolicyTypeEnforceAllDirectives,
+ WebContentSecurityPolicyTypeReport,
+ WebContentSecurityPolicyTypeEnforce,
+ WebContentSecurityPolicyTypePrefixedReport,
+ WebContentSecurityPolicyTypePrefixedEnforce,
};
} // namespace WebKit
Modified: trunk/Source/WebKit/chromium/src/AssertMatchingEnums.cpp (144570 => 144571)
--- trunk/Source/WebKit/chromium/src/AssertMatchingEnums.cpp 2013-03-03 10:47:41 UTC (rev 144570)
+++ trunk/Source/WebKit/chromium/src/AssertMatchingEnums.cpp 2013-03-03 11:06:19 UTC (rev 144571)
@@ -612,10 +612,10 @@
COMPILE_ASSERT_MATCHING_ENUM(WebReferrerPolicyNever, ReferrerPolicyNever);
COMPILE_ASSERT_MATCHING_ENUM(WebReferrerPolicyOrigin, ReferrerPolicyOrigin);
-COMPILE_ASSERT_MATCHING_ENUM(WebContentSecurityPolicyTypeReportStableDirectives, ContentSecurityPolicy::ReportStableDirectives);
-COMPILE_ASSERT_MATCHING_ENUM(WebContentSecurityPolicyTypeEnforceStableDirectives, ContentSecurityPolicy::EnforceStableDirectives);
-COMPILE_ASSERT_MATCHING_ENUM(WebContentSecurityPolicyTypeReportAllDirectives, ContentSecurityPolicy::ReportAllDirectives);
-COMPILE_ASSERT_MATCHING_ENUM(WebContentSecurityPolicyTypeEnforceAllDirectives, ContentSecurityPolicy::EnforceAllDirectives);
+COMPILE_ASSERT_MATCHING_ENUM(WebContentSecurityPolicyTypeReport, ContentSecurityPolicy::Report);
+COMPILE_ASSERT_MATCHING_ENUM(WebContentSecurityPolicyTypeEnforce, ContentSecurityPolicy::Enforce);
+COMPILE_ASSERT_MATCHING_ENUM(WebContentSecurityPolicyTypePrefixedReport, ContentSecurityPolicy::PrefixedReport);
+COMPILE_ASSERT_MATCHING_ENUM(WebContentSecurityPolicyTypePrefixedEnforce, ContentSecurityPolicy::PrefixedEnforce);
COMPILE_ASSERT_MATCHING_ENUM(WebURLResponse::Unknown, ResourceResponse::Unknown);
COMPILE_ASSERT_MATCHING_ENUM(WebURLResponse::HTTP_0_9, ResourceResponse::HTTP_0_9);
