Changeset 286136 in webkit


Ignore:
Timestamp:
Nov 23, 2021 8:24:27 AM (8 months ago)
Author:
Carlos Garcia Campos
Message:

CSP: security policy violation event is always using document as target
​https://bugs.webkit.org/show_bug.cgi?id=233182

Reviewed by Kate Cheney.

LayoutTests/imported/w3c:

Update test expectations.

  • web-platform-tests/content-security-policy/script-src/javascript-window-open-blocked-expected.txt:
  • web-platform-tests/content-security-policy/securitypolicyviolation/source-file-blob-scheme-expected.txt:
  • web-platform-tests/content-security-policy/securitypolicyviolation/source-file-data-scheme-expected.txt:
  • web-platform-tests/content-security-policy/securitypolicyviolation/style-sample-expected.txt:
  • web-platform-tests/content-security-policy/securitypolicyviolation/style-sample-no-opt-in-expected.txt:

Source/WebCore:

We should use the violation element instead if not null.

  • bindings/js/JSEventListener.cpp:

(WebCore::JSEventListener::handleEvent): Pass element to allowInlineEventHandlers().

  • bindings/js/JSLazyEventListener.cpp:

(WebCore::JSLazyEventListener::initializeJSFunction const): Ditto.

  • dom/Element.cpp:

(WebCore::Element::enqueueSecurityPolicyViolationEvent): Helper to queue securitypolicyviolationEvent for element.

  • dom/Element.h:
  • dom/InlineStyleSheetOwner.cpp:

(WebCore::InlineStyleSheetOwner::createSheet): Pass element to allowInlineStyle().

  • dom/ScriptElement.cpp:

(WebCore::ScriptElement::requestModuleScript): Pass element to allowInlineScript().
(WebCore::ScriptElement::executeClassicScript): Ditto.

  • dom/StyledElement.cpp:

(WebCore::StyledElement::styleAttributeChanged): Pass element to allowInlineStyle().

  • page/csp/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::allowInlineEventHandlers const): Pass given element to reportViolation().
(WebCore::ContentSecurityPolicy::allowInlineScript const): Ditto.
(WebCore::ContentSecurityPolicy::allowInlineStyle const): Ditto.
(WebCore::ContentSecurityPolicy::reportViolation const): Call Element::enqueueSecurityPolicyViolationEvent() if
element is not nullptr.

  • page/csp/ContentSecurityPolicy.h:

LayoutTests:

Unskip tests that no longer time out.

Location:
trunk
Files:
18 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r286133 r286136  
     12021-11-23  Carlos Garcia Campos  <cgarcia@igalia.com>
     2
     3        CSP: security policy violation event is always using document as target
     4        https://bugs.webkit.org/show_bug.cgi?id=233182
     5
     6        Reviewed by Kate Cheney.
     7
     8        Unskip tests that no longer time out.
     9
     10        * TestExpectations:
     11
    1122021-11-23  Alan Bujtas  <zalan@apple.com>
    213

  • trunk/LayoutTests/TestExpectations

    r286123 r286136  
    526526imported/w3c/web-platform-tests/content-security-policy/prefetch-src/prefetch-header-blocked-by-default.html [ Skip ]
    527527imported/w3c/web-platform-tests/content-security-policy/reporting-api/report-to-directive-allowed-in-meta.https.sub.html [ Skip ]
    528 imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/source-file-blob-scheme.html [ Skip ]
    529 imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/source-file-data-scheme.html [ Skip ]
    530528imported/w3c/web-platform-tests/cookies/domain/domain-attribute-host-with-and-without-leading-period.sub.https.html [ Skip ]
    531529imported/w3c/web-platform-tests/cookies/domain/domain-attribute-host-with-leading-period.sub.https.html [ Skip ]
    … …  
    951949imported/w3c/web-platform-tests/content-security-policy/navigate-to/href-location-cross-origin-allowed.sub.html [ Skip ]
    952950imported/w3c/web-platform-tests/content-security-policy/style-src/style-src-inline-style-nonce-blocked-error-event.html [ Skip ]
    953 imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/style-sample.html [ Skip ]
    954 imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/style-sample-no-opt-in.html [ Skip ]
    955951imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/inside-dedicated-worker.html [ Skip ]
    956952imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/img-src-redirect-upgrade-reporting.https.html [ Skip ]
    … …  
    981977imported/w3c/web-platform-tests/content-security-policy/navigate-to/unsafe-allow-redirects/blocked-end-of-chain.sub.html [ Skip ]
    982978imported/w3c/web-platform-tests/content-security-policy/reporting-api/reporting-api-works-on-frame-src.https.sub.html [ Skip ]
    983 imported/w3c/web-platform-tests/content-security-policy/script-src/javascript-window-open-blocked.html [ Skip ]
    984979imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/script-sample-no-opt-in.html [ Skip ]
    985980imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/script-sample.html [ Skip ]

  • trunk/LayoutTests/imported/w3c/ChangeLog

    r286135 r286136  
     12021-11-23  Carlos Garcia Campos  <cgarcia@igalia.com>
     2
     3        CSP: security policy violation event is always using document as target
     4        https://bugs.webkit.org/show_bug.cgi?id=233182
     5
     6        Reviewed by Kate Cheney.
     7
     8        Update test expectations.
     9
     10        * web-platform-tests/content-security-policy/script-src/javascript-window-open-blocked-expected.txt:
     11        * web-platform-tests/content-security-policy/securitypolicyviolation/source-file-blob-scheme-expected.txt:
     12        * web-platform-tests/content-security-policy/securitypolicyviolation/source-file-data-scheme-expected.txt:
     13        * web-platform-tests/content-security-policy/securitypolicyviolation/style-sample-expected.txt:
     14        * web-platform-tests/content-security-policy/securitypolicyviolation/style-sample-no-opt-in-expected.txt:
     15
    1162021-11-23  Antti Koivisto  <antti@apple.com>
    217

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/javascript-window-open-blocked-expected.txt

    r283111 r286136  
    1  
    2 FAIL Check that a securitypolicyviolation event is fired assert_equals: expected "inline" but got ""
    31
     2PASS Check that a securitypolicyviolation event is fired
     3

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/source-file-blob-scheme-expected.txt

    r279838 r286136  
    11
    2 Harness Error (TIMEOUT), message = null
     2FAIL Violations from data:-URL scripts have a sourceFile of 'blob' assert_equals: expected 16 but got 21
    33
    4 TIMEOUT Violations from data:-URL scripts have a sourceFile of 'blob' Test timed out
    5 

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/source-file-data-scheme-expected.txt

    r279838 r286136  
    11
    2 Harness Error (TIMEOUT), message = null
     2FAIL Violations from data:-URL scripts have a sourceFile of 'data' assert_equals: expected 16 but got 21
    33
    4 TIMEOUT Violations from data:-URL scripts have a sourceFile of 'data' Test timed out
    5 

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/style-sample-expected.txt

    r259900 r286136  
    1 CONSOLE MESSAGE: The source list for Content Security Policy directive 'style-src' contains an invalid source: ''report-sample''. It will be ignored.
    2 CONSOLE MESSAGE: Refused to apply a stylesheet because its hash, its nonce, or 'unsafe-inline' does not appear in the style-src directive of the Content Security Policy.
    3 CONSOLE MESSAGE: Refused to apply a stylesheet because its hash, its nonce, or 'unsafe-inline' does not appear in the style-src directive of the Content Security Policy.
    41
    5 Harness Error (TIMEOUT), message = null
     2FAIL Inline style blocks should have a sample. assert_equals: expected "p { omg: yay !important; }" but got ""
     3FAIL Inline style attributes should have a sample. assert_equals: expected "omg: yay !important;" but got ""
    64
    7 TIMEOUT Inline style blocks should have a sample. Test timed out
    8 TIMEOUT Inline style attributes should have a sample. Test timed out
    9 

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/style-sample-no-opt-in-expected.txt

    r259900 r286136  
    1 CONSOLE MESSAGE: Refused to apply a stylesheet because its hash, its nonce, or 'unsafe-inline' does not appear in the style-src directive of the Content Security Policy.
    2 CONSOLE MESSAGE: Refused to apply a stylesheet because its hash, its nonce, or 'unsafe-inline' does not appear in the style-src directive of the Content Security Policy.
    31
    4 Harness Error (TIMEOUT), message = null
     2PASS Inline style blocks should not have a sample.
     3PASS Inline style attributes should not have a sample.
    54
    6 TIMEOUT Inline style blocks should not have a sample. Test timed out
    7 TIMEOUT Inline style attributes should not have a sample. Test timed out
    8 

  • trunk/Source/WebCore/ChangeLog

    r286135 r286136  
     12021-11-23  Carlos Garcia Campos  <cgarcia@igalia.com>
     2
     3        CSP: security policy violation event is always using document as target
     4        https://bugs.webkit.org/show_bug.cgi?id=233182
     5
     6        Reviewed by Kate Cheney.
     7
     8        We should use the violation element instead if not null.
     9
     10        * bindings/js/JSEventListener.cpp:
     11        (WebCore::JSEventListener::handleEvent): Pass element to allowInlineEventHandlers().
     12        * bindings/js/JSLazyEventListener.cpp:
     13        (WebCore::JSLazyEventListener::initializeJSFunction const): Ditto.
     14        * dom/Element.cpp:
     15        (WebCore::Element::enqueueSecurityPolicyViolationEvent): Helper to queue securitypolicyviolationEvent for element.
     16        * dom/Element.h:
     17        * dom/InlineStyleSheetOwner.cpp:
     18        (WebCore::InlineStyleSheetOwner::createSheet): Pass element to allowInlineStyle().
     19        * dom/ScriptElement.cpp:
     20        (WebCore::ScriptElement::requestModuleScript): Pass element to allowInlineScript().
     21        (WebCore::ScriptElement::executeClassicScript): Ditto.
     22        * dom/StyledElement.cpp:
     23        (WebCore::StyledElement::styleAttributeChanged): Pass element to allowInlineStyle().
     24        * page/csp/ContentSecurityPolicy.cpp:
     25        (WebCore::ContentSecurityPolicy::allowInlineEventHandlers const): Pass given element to reportViolation().
     26        (WebCore::ContentSecurityPolicy::allowInlineScript const): Ditto.
     27        (WebCore::ContentSecurityPolicy::allowInlineStyle const): Ditto.
     28        (WebCore::ContentSecurityPolicy::reportViolation const): Call Element::enqueueSecurityPolicyViolationEvent() if
     29        element is not nullptr.
     30        * page/csp/ContentSecurityPolicy.h:
     31
    1322021-11-23  Antti Koivisto  <antti@apple.com>
    233

  • trunk/Source/WebCore/bindings/js/JSEventListener.cpp

    r284067 r286136  
    127127        if (!window->wrapped().isCurrentlyDisplayedInFrame())
    128128            return;
    129         if (wasCreatedFromMarkup() && !scriptExecutionContext.contentSecurityPolicy()->allowInlineEventHandlers(sourceURL().string(), sourcePosition().m_line, code()))
    130             return;
     129        if (wasCreatedFromMarkup()) {
     130            Element* element = event.target()->isNode() && !downcast<Node>(*event.target()).isDocumentNode() && is<Element>(*event.target()) ? downcast<Element>(event.target()) : nullptr;
     131            if (!scriptExecutionContext.contentSecurityPolicy()->allowInlineEventHandlers(sourceURL().string(), sourcePosition().m_line, code(), element))
     132                return;
     133        }
    131134        // FIXME: Is this check needed for other contexts?
    132135        ScriptController& script = window->wrapped().frame()->script();

  • trunk/Source/WebCore/bindings/js/JSLazyEventListener.cpp

    r284080 r286136  
    132132        return nullptr;
    133133
    134     if (!document.contentSecurityPolicy()->allowInlineEventHandlers(m_sourceURL.string(), m_sourcePosition.m_line, m_code))
     134    Element* element = m_originalNode && !m_originalNode->isDocumentNode() && is<Element>(*m_originalNode) ? downcast<Element>(m_originalNode.get()) : nullptr;
     135    if (!document.contentSecurityPolicy()->allowInlineEventHandlers(m_sourceURL.string(), m_sourcePosition.m_line, m_code, element))
    135136        return nullptr;
    136137

  • trunk/Source/WebCore/dom/Element.cpp

    r286119 r286136  
    5454#include "EventDispatcher.h"
    5555#include "EventHandler.h"
     56#include "EventLoop.h"
    5657#include "EventNames.h"
    5758#include "FocusController.h"
    … …  
    111112#include "ScrollIntoViewOptions.h"
    112113#include "ScrollLatchingController.h"
     114#include "SecurityPolicyViolationEvent.h"
    113115#include "SelectorQuery.h"
    114116#include "Settings.h"
    … …  
    31993201}
    32003202
     3203void Element::enqueueSecurityPolicyViolationEvent(SecurityPolicyViolationEventInit&& eventInit)
     3204{
     3205    document().eventLoop().queueTask(TaskSource::DOMManipulation, [this, protectedThis = Ref { *this }, event = SecurityPolicyViolationEvent::create(eventNames().securitypolicyviolationEvent, WTFMove(eventInit), Event::IsTrusted::Yes)] {
     3206        dispatchEvent(event);
     3207    });
     3208}
     3209
    32013210ExceptionOr<void> Element::mergeWithNextTextNode(Text& node)
    32023211{

  • trunk/Source/WebCore/dom/Element.h

    r286115 r286136  
    8989struct ScrollIntoViewOptions;
    9090struct ScrollToOptions;
     91struct SecurityPolicyViolationEventInit;
    9192struct ShadowRootInit;
    9293
    … …  
    572573    WEBCORE_EXPORT bool dispatchMouseForceWillBegin();
    573574
     575    void enqueueSecurityPolicyViolationEvent(SecurityPolicyViolationEventInit&&);
     576
    574577    virtual void willRecalcStyle(Style::Change);
    575578    virtual void didRecalcStyle(Style::Change);

  • trunk/Source/WebCore/dom/InlineStyleSheetOwner.cpp

    r285478 r286136  
    170170    const ContentSecurityPolicy& contentSecurityPolicy = *document.contentSecurityPolicy();
    171171    bool hasKnownNonce = contentSecurityPolicy.allowStyleWithNonce(element.nonce(), element.isInUserAgentShadowTree());
    172     if (!contentSecurityPolicy.allowInlineStyle(document.url().string(), m_startTextPosition.m_line, text, CheckUnsafeHashes::No, hasKnownNonce))
     172    if (!contentSecurityPolicy.allowInlineStyle(document.url().string(), m_startTextPosition.m_line, text, CheckUnsafeHashes::No, element, hasKnownNonce))
    173173        return;
    174174

  • trunk/Source/WebCore/dom/ScriptElement.cpp

    r285478 r286136  
    378378    const auto& contentSecurityPolicy = *m_element.document().contentSecurityPolicy();
    379379    bool hasKnownNonce = contentSecurityPolicy.allowScriptWithNonce(nonce, m_element.isInUserAgentShadowTree());
    380     if (!contentSecurityPolicy.allowInlineScript(m_element.document().url().string(), m_startLineNumber, sourceCode.source(), hasKnownNonce))
     380    if (!contentSecurityPolicy.allowInlineScript(m_element.document().url().string(), m_startLineNumber, sourceCode.source(), m_element, hasKnownNonce))
    381381        return false;
    382382
    … …  
    402402
    403403        bool hasKnownNonce = contentSecurityPolicy.allowScriptWithNonce(m_element.nonce(), m_element.isInUserAgentShadowTree());
    404         if (!contentSecurityPolicy.allowInlineScript(m_element.document().url().string(), m_startLineNumber, sourceCode.source(), hasKnownNonce))
     404        if (!contentSecurityPolicy.allowInlineScript(m_element.document().url().string(), m_startLineNumber, sourceCode.source(), m_element, hasKnownNonce))
    405405            return;
    406406    }

  • trunk/Source/WebCore/dom/StyledElement.cpp

    r284857 r286136  
    207207        startLineNumber = document().scriptableDocumentParser()->textPosition().m_line;
    208208
    209     if (reason == ModifiedByCloning || document().contentSecurityPolicy()->allowInlineStyle(document().url().string(), startLineNumber, newStyleString.string(), CheckUnsafeHashes::Yes, isInUserAgentShadowTree()))
     209    if (reason == ModifiedByCloning || document().contentSecurityPolicy()->allowInlineStyle(document().url().string(), startLineNumber, newStyleString.string(), CheckUnsafeHashes::Yes, *this, isInUserAgentShadowTree()))
    210210        setInlineStyleFromString(newStyleString);
    211211

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicy.cpp

    r286094 r286136  
    417417}
    418418
    419 bool ContentSecurityPolicy::allowInlineEventHandlers(const String& contextURL, const OrdinalNumber& contextLine, const String& source, bool overrideContentSecurityPolicy) const
     419bool ContentSecurityPolicy::allowInlineEventHandlers(const String& contextURL, const OrdinalNumber& contextLine, const String& source, Element* element, bool overrideContentSecurityPolicy) const
    420420{
    421421    if (overrideContentSecurityPolicy)
    … …  
    424424    auto handleViolatedDirective = [&] (const ContentSecurityPolicyDirective& violatedDirective) {
    425425        String consoleMessage = consoleMessageForViolation(ContentSecurityPolicyDirectiveNames::scriptSrc, violatedDirective, URL(), "Refused to execute a script for an inline event handler", "'unsafe-inline'");
    426         reportViolation(ContentSecurityPolicyDirectiveNames::scriptSrc, violatedDirective, "inline"_s, consoleMessage, contextURL, TextPosition(contextLine, OrdinalNumber()));
     426        reportViolation(ContentSecurityPolicyDirectiveNames::scriptSrc, violatedDirective, "inline"_s, consoleMessage, contextURL, TextPosition(contextLine, OrdinalNumber()), URL(), nullptr, element);
    427427        if (!didNotifyInspector && !violatedDirective.directiveList().isReportOnly()) {
    428428            reportBlockedScriptExecutionToInspector(violatedDirective.text());
    … …  
    481481}
    482482
    483 bool ContentSecurityPolicy::allowInlineScript(const String& contextURL, const OrdinalNumber& contextLine, StringView scriptContent, bool overrideContentSecurityPolicy) const
     483bool ContentSecurityPolicy::allowInlineScript(const String& contextURL, const OrdinalNumber& contextLine, StringView scriptContent, Element& element, bool overrideContentSecurityPolicy) const
    484484{
    485485    if (overrideContentSecurityPolicy || shouldPerformEarlyCSPCheck())
    … …  
    488488    auto handleViolatedDirective = [&] (const ContentSecurityPolicyDirective& violatedDirective) {
    489489        String consoleMessage = consoleMessageForViolation(ContentSecurityPolicyDirectiveNames::scriptSrc, violatedDirective, URL(), "Refused to execute a script", "its hash, its nonce, or 'unsafe-inline'");
    490         reportViolation(ContentSecurityPolicyDirectiveNames::scriptSrc, violatedDirective, "inline"_s, consoleMessage, contextURL, TextPosition(contextLine, OrdinalNumber()));
     490        reportViolation(ContentSecurityPolicyDirectiveNames::scriptSrc, violatedDirective, "inline"_s, consoleMessage, contextURL, TextPosition(contextLine, OrdinalNumber()), URL(), nullptr, &element);
    491491        if (!didNotifyInspector && !violatedDirective.directiveList().isReportOnly()) {
    492492            reportBlockedScriptExecutionToInspector(violatedDirective.text());
    … …  
    499499}
    500500
    501 bool ContentSecurityPolicy::allowInlineStyle(const String& contextURL, const OrdinalNumber& contextLine, StringView styleContent, CheckUnsafeHashes shouldCheckUnsafeHashes, bool overrideContentSecurityPolicy) const
     501bool ContentSecurityPolicy::allowInlineStyle(const String& contextURL, const OrdinalNumber& contextLine, StringView styleContent, CheckUnsafeHashes shouldCheckUnsafeHashes, Element& element, bool overrideContentSecurityPolicy) const
    502502{
    503503    if (overrideContentSecurityPolicy)
    … …  
    508508        auto name = shouldCheckUnsafeHashes == CheckUnsafeHashes::Yes ? ContentSecurityPolicyDirectiveNames::styleSrcAttr : ContentSecurityPolicyDirectiveNames::styleSrcElem;
    509509        String consoleMessage = consoleMessageForViolation(ContentSecurityPolicyDirectiveNames::styleSrc, violatedDirective, URL(), "Refused to apply a stylesheet", "its hash, its nonce, or 'unsafe-inline'");
    510         reportViolation(name, violatedDirective, "inline"_s, consoleMessage, contextURL, TextPosition(contextLine, OrdinalNumber()));
     510        reportViolation(name, violatedDirective, "inline"_s, consoleMessage, contextURL, TextPosition(contextLine, OrdinalNumber()), URL(), nullptr, &element);
    511511    };
    512512
    … …  
    735735}
    736736
    737 void ContentSecurityPolicy::reportViolation(const String& effectiveViolatedDirective, const ContentSecurityPolicyDirective& violatedDirective, const String& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, const URL& preRedirectURL, JSC::JSGlobalObject* state) const
    738 {
    739     return reportViolation(effectiveViolatedDirective, violatedDirective.nameForReporting().convertToASCIILowercase(), violatedDirective.directiveList(), blockedURL, consoleMessage, sourceURL, sourcePosition, state, preRedirectURL);
    740 }
    741 
    742 void ContentSecurityPolicy::reportViolation(const String& effectiveViolatedDirective, const String& violatedDirective, const ContentSecurityPolicyDirectiveList& violatedDirectiveList, const String& blockedURLString, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, JSC::JSGlobalObject* state, const URL& preRedirectURL) const
     737void ContentSecurityPolicy::reportViolation(const String& effectiveViolatedDirective, const ContentSecurityPolicyDirective& violatedDirective, const String& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, const URL& preRedirectURL, JSC::JSGlobalObject* state, Element* element) const
     738{
     739    return reportViolation(effectiveViolatedDirective, violatedDirective.nameForReporting().convertToASCIILowercase(), violatedDirective.directiveList(), blockedURL, consoleMessage, sourceURL, sourcePosition, state, preRedirectURL, element);
     740}
     741
     742void ContentSecurityPolicy::reportViolation(const String& effectiveViolatedDirective, const String& violatedDirective, const ContentSecurityPolicyDirectiveList& violatedDirectiveList, const String& blockedURLString, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, JSC::JSGlobalObject* state, const URL& preRedirectURL, Element* element) const
    743743{
    744744    logToConsole(consoleMessage, sourceURL, sourcePosition.m_line, sourcePosition.m_column, state);
    … …  
    805805    if (m_client)
    806806        m_client->enqueueSecurityPolicyViolationEvent(WTFMove(violationEventInit));
    807     else
    808         downcast<Document>(*m_scriptExecutionContext).enqueueSecurityPolicyViolationEvent(WTFMove(violationEventInit));
     807    else {
     808        auto& document = downcast<Document>(*m_scriptExecutionContext);
     809        if (element && element->document() == document)
     810            element->enqueueSecurityPolicyViolationEvent(WTFMove(violationEventInit));
     811        else
     812            document.enqueueSecurityPolicyViolationEvent(WTFMove(violationEventInit));
     813    }
    809814
    810815    // 2. Send violation report (if applicable).

  • trunk/Source/WebCore/page/csp/ContentSecurityPolicy.h

    r286094 r286136  
    5252class ContentSecurityPolicySource;
    5353class DOMStringList;
     54class Element;
    5455class Frame;
    5556class JSWindowProxy;
    … …  
    9697
    9798    bool allowJavaScriptURLs(const String& contextURL, const OrdinalNumber& contextLine, const String& code, bool overrideContentSecurityPolicy = false) const;
    98     bool allowInlineEventHandlers(const String& contextURL, const OrdinalNumber& contextLine, const String& code, bool overrideContentSecurityPolicy = false) const;
    99     bool allowInlineScript(const String& contextURL, const OrdinalNumber& contextLine, StringView scriptContent, bool overrideContentSecurityPolicy = false) const;
     99    bool allowInlineEventHandlers(const String& contextURL, const OrdinalNumber& contextLine, const String& code, Element*, bool overrideContentSecurityPolicy = false) const;
     100    bool allowInlineScript(const String& contextURL, const OrdinalNumber& contextLine, StringView scriptContent, Element&, bool overrideContentSecurityPolicy = false) const;
    100101    bool allowNonParserInsertedScripts(const URL&, const String&, const StringView&, ParserInserted) const;
    101     bool allowInlineStyle(const String& contextURL, const OrdinalNumber& contextLine, StringView styleContent, CheckUnsafeHashes, bool overrideContentSecurityPolicy = false) const;
     102    bool allowInlineStyle(const String& contextURL, const OrdinalNumber& contextLine, StringView styleContent, CheckUnsafeHashes, Element&, bool overrideContentSecurityPolicy = false) const;
    102103
    103104    bool allowEval(JSC::JSGlobalObject*, LogToConsole, bool overrideContentSecurityPolicy = false) const;
    … …  
    223224    void reportViolation(const String& effectiveViolatedDirective, const ContentSecurityPolicyDirective& violatedDirective, const String& blockedURL, const String& consoleMessage, JSC::JSGlobalObject*) const;
    224225    void reportViolation(const String& effectiveViolatedDirective, const String& violatedDirective, const ContentSecurityPolicyDirectiveList&, const String& blockedURL, const String& consoleMessage, JSC::JSGlobalObject* = nullptr) const;
    225     void reportViolation(const String& effectiveViolatedDirective, const ContentSecurityPolicyDirective& violatedDirective, const String& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, const URL& preRedirectURL = URL(), JSC::JSGlobalObject* = nullptr) const;
    226     void reportViolation(const String& effectiveViolatedDirective, const String& violatedDirective, const ContentSecurityPolicyDirectiveList& violatedDirectiveList, const String& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, JSC::JSGlobalObject*, const URL& preRedirectURL = URL()) const;
     226    void reportViolation(const String& effectiveViolatedDirective, const ContentSecurityPolicyDirective& violatedDirective, const String& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, const URL& preRedirectURL = URL(), JSC::JSGlobalObject* = nullptr, Element* = nullptr) const;
     227    void reportViolation(const String& effectiveViolatedDirective, const String& violatedDirective, const ContentSecurityPolicyDirectiveList& violatedDirectiveList, const String& blockedURL, const String& consoleMessage, const String& sourceURL, const TextPosition& sourcePosition, JSC::JSGlobalObject*, const URL& preRedirectURL = URL(), Element* = nullptr) const;
    227228    void reportBlockedScriptExecutionToInspector(const String& directiveText) const;
    228229
Note: See TracChangeset for help on using the changeset viewer.