Changeset 109730 in webkit

Timestamp:

Mar 5, 2012 2:44:40 AM (12 years ago)

Author:

apavlov@chromium.org

Message:

Web Inspector: [Styles] [CRASH] Handle rule addition and inline style editing failure due to Content-Security-Policy in the page
​https://bugs.webkit.org/show_bug.cgi?id=80024

Reviewed by Pavel Feldman.

Source/WebCore:

Test: inspector/styles/add-new-rule-inline-style-csp.html

• inspector/InspectorCSSAgent.cpp:

(WebCore::InspectorCSSAgent::viaInspectorStyleSheet):

• inspector/InspectorCSSAgent.h:

(InlineStyleOverrideScope):
(WebCore::InspectorCSSAgent::InlineStyleOverrideScope::InlineStyleOverrideScope):
(WebCore::InspectorCSSAgent::InlineStyleOverrideScope::~InlineStyleOverrideScope):
(InspectorCSSAgent):

• inspector/InspectorStyleSheet.cpp:

(WebCore::InspectorStyleSheetForInlineStyle::setStyleText):

• page/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::ContentSecurityPolicy):
(WebCore::ContentSecurityPolicy::allowInlineStyle):
(WebCore::ContentSecurityPolicy::setOverrideAllowInlineStyle):
(WebCore):

• page/ContentSecurityPolicy.h:

(ContentSecurityPolicy):

LayoutTests:

• inspector/styles/add-new-rule-inline-style-csp-expected.txt: Added.
• inspector/styles/add-new-rule-inline-style-csp.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/inspector/styles/add-new-rule-inline-style-csp-expected.txt (added)
• LayoutTests/inspector/styles/add-new-rule-inline-style-csp.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/inspector/InspectorCSSAgent.cpp (modified) (3 diffs)
• Source/WebCore/inspector/InspectorCSSAgent.h (modified) (3 diffs)
• Source/WebCore/inspector/InspectorStyleSheet.cpp (modified) (2 diffs)
• Source/WebCore/page/ContentSecurityPolicy.cpp (modified) (3 diffs)
• Source/WebCore/page/ContentSecurityPolicy.h (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2012-03-02  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Styles] [CRASH] Handle rule addition and inline style editing failure due to Content-Security-Policy in the page
+        https://bugs.webkit.org/show_bug.cgi?id=80024
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/styles/add-new-rule-inline-style-csp-expected.txt: Added.
+        * inspector/styles/add-new-rule-inline-style-csp.html: Added.
+
 2012-03-05  Pavel Podivilov  <podivilov@chromium.org>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-03-02  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Styles] [CRASH] Handle rule addition and inline style editing failure due to Content-Security-Policy in the page
+        https://bugs.webkit.org/show_bug.cgi?id=80024
+
+        Reviewed by Pavel Feldman.
+
+        Test: inspector/styles/add-new-rule-inline-style-csp.html
+
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::viaInspectorStyleSheet):
+        * inspector/InspectorCSSAgent.h:
+        (InlineStyleOverrideScope):
+        (WebCore::InspectorCSSAgent::InlineStyleOverrideScope::InlineStyleOverrideScope):
+        (WebCore::InspectorCSSAgent::InlineStyleOverrideScope::~InlineStyleOverrideScope):
+        (InspectorCSSAgent):
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheetForInlineStyle::setStyleText):
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::ContentSecurityPolicy::ContentSecurityPolicy):
+        (WebCore::ContentSecurityPolicy::allowInlineStyle):
+        (WebCore::ContentSecurityPolicy::setOverrideAllowInlineStyle):
+        (WebCore):
+        * page/ContentSecurityPolicy.h:
+        (ContentSecurityPolicy):
+
 2012-03-05  Yoshifumi Inoue  <yosin@chromium.org>
 

trunk/Source/WebCore/inspector/InspectorCSSAgent.cpp

@@ -37 +37 @@
 #include "CSSStyleSelector.h"
 #include "CSSStyleSheet.h"
+#include "ContentSecurityPolicy.h"
 #include "DOMWindow.h"
 #include "HTMLHeadElement.h"
@@ -897 +898 @@
         else
             return 0;
+
+        InlineStyleOverrideScope overrideScope(document);
         targetNode->appendChild(styleElement, ec);
     }
@@ -903 +906 @@
     StyleSheetList* styleSheets = document->styleSheets();
     StyleSheet* styleSheet = styleSheets->item(styleSheets->length() - 1);
-    if (!styleSheet->isCSSStyleSheet())
+    if (!styleSheet || !styleSheet->isCSSStyleSheet())
         return 0;
     CSSStyleSheet* cssStyleSheet = static_cast<CSSStyleSheet*>(styleSheet);

trunk/Source/WebCore/inspector/InspectorCSSAgent.h

@@ -27 +27 @@
 
 #include "CSSSelector.h"
+#include "ContentSecurityPolicy.h"
 #include "Document.h"
 #include "InspectorBaseAgent.h"
@@ -33 +34 @@
 #include "InspectorValues.h"
 #include "PlatformString.h"
+#include "SecurityContext.h"
 
 #include <wtf/HashMap.h>
@@ -62 +64 @@
     WTF_MAKE_NONCOPYABLE(InspectorCSSAgent);
 public:
+    class InlineStyleOverrideScope {
+    public:
+        InlineStyleOverrideScope(SecurityContext* context)
+            : m_contentSecurityPolicy(context->contentSecurityPolicy())
+        {
+            m_contentSecurityPolicy->setOverrideAllowInlineStyle(true);
+        }
+
+        ~InlineStyleOverrideScope()
+        {
+            m_contentSecurityPolicy->setOverrideAllowInlineStyle(false);
+        }
+
+    private:
+        ContentSecurityPolicy* m_contentSecurityPolicy;
+    };
+
     static CSSStyleRule* asCSSStyleRule(CSSRule*);
 

trunk/Source/WebCore/inspector/InspectorStyleSheet.cpp

@@ -37 +37 @@
 #include "CSSStyleSelector.h"
 #include "CSSStyleSheet.h"
+#include "ContentSecurityPolicy.h"
 #include "Document.h"
 #include "Element.h"
@@ -1320 +1321 @@
     ASSERT_UNUSED(style, style == inlineStyle());
     ExceptionCode ec = 0;
-    m_element->setAttribute("style", text, ec);
+
+    {
+        InspectorCSSAgent::InlineStyleOverrideScope overrideScope(m_element->ownerDocument());
+        m_element->setAttribute("style", text, ec);
+    }
+
     m_styleText = text;
     m_isStyleTextValid = true;

trunk/Source/WebCore/page/ContentSecurityPolicy.cpp

@@ -488 +488 @@
     , m_reportOnly(false)
     , m_haveSandboxPolicy(false)
+    , m_overrideInlineStyleAllowed(false)
 {
 }
@@ -623 +624 @@
 {
     DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to apply inline style because of Content-Security-Policy.\n"));
-    return checkInlineAndReportViolation(operativeDirective(m_styleSrc.get()), consoleMessage);
+    return m_overrideInlineStyleAllowed || checkInlineAndReportViolation(operativeDirective(m_styleSrc.get()), consoleMessage);
 }
 
@@ -678 +679 @@
     DEFINE_STATIC_LOCAL(String, type, ("connect"));
     return checkSourceAndReportViolation(operativeDirective(m_connectSrc.get()), url, type);
+}
+
+void ContentSecurityPolicy::setOverrideAllowInlineStyle(bool value)
+{
+    m_overrideInlineStyleAllowed = value;
 }
 

trunk/Source/WebCore/page/ContentSecurityPolicy.h

@@ -71 +71 @@
     bool allowConnectFromSource(const KURL&) const;
 
+    void setOverrideAllowInlineStyle(bool);
+
 private:
     explicit ContentSecurityPolicy(ScriptExecutionContext*);
@@ -108 +110 @@
     OwnPtr<CSPDirective> m_connectSrc;
     bool m_haveSandboxPolicy;
+    bool m_overrideInlineStyleAllowed;
     Vector<KURL> m_reportURLs;
 };