Changeset 133095 in webkit


Ignore:
Timestamp:
Oct 31, 2012 4:41:27 PM (11 years ago)
Author:
mkwst@chromium.org
Message:

Implement the canonical "Content-Security-Policy" header.
​https://bugs.webkit.org/show_bug.cgi?id=96765

Reviewed by Adam Barth.

Source/WebCore:

The CSP 1.0 specification defines the "Content-Security-Policy" header
as the canonical mechanism of defining a resource's security policy. Up
through this patch, we've implemented the functionality behind a prefix
in order to ensure compatibility with the standard once it's released as
a recommendation. Both the specification and WebKit's implementation are
far enough along in that process that it makes sense to support the
unprefixed header for sites that wish to opt-in to CSP 1.0.

As discussed on public-webappsec[1], we'll keep the experimental 1.1
features behind the prefixed header ('X-WebKit-CSP') until that standard
is far enough along to justify moving them out to the canonical header.

This patch defines the 'Content-Security-Policy' header for all ports,
just as the 'X-WebKit-CSP' header is currently supported on all ports.
Ports that have not opted-in to the CSP_NEXT flag will see exactly the
same behavior with both headers. Ports that have opted-in will see much
of CSP 1.1's current definition on the prefixed header, and CSP 1.0 on
the canonical header.

The functionality in this change is covered by the changes made to
existing tests. No expectations changed, only the headers that are sent.

  • dom/Document.cpp:

(WebCore::Document::processHttpEquiv):

Add canonical header support to 'meta' element definitions.

  • loader/FrameLoader.cpp:

(WebCore::FrameLoader::didBeginDocument):

Add canonical header support to FrameLoader.

  • page/ContentSecurityPolicy.cpp:

(WebCore::CSPDirectiveList::headerType):

The ContentSecurityPolicy::HeaderType enum now has four values:
prefixed/report-only, unprefixed/report-only, prefixed/enforce, and
unprefixed/enforce. Instead of creating logic to output the proper
type based on internal flags, CSPDirectiveList now saves the value
provided at creation time, and returns it via this method.

(CSPDirectiveList):
(WebCore::CSPDirectiveList::CSPDirectiveList):

The constructor now accepts a type, which is stored on the object.
It also stores a new internal variable, 'm_experimental', which
defines whether or not experimental features ought to be available.
These features are still locked behind the CSP_NEXT flag, but that
might not be the case forever.

(WebCore::CSPDirectiveList::create):

The static constructor wrapper now passes the type into the real
constructor, which also now handles setting its internal variables.

(WebCore::CSPDirectiveList::parse):

'parse()' is given the header, so it makes sense to store it here as
well, rather than in the create wrapper.

(WebCore::CSPDirectiveList::addDirective):

1.1 directives remain locked behind CSP_NEXT, but now also require
that 'm_experimental' is set, signaling usage of the prefixed header
and an implicit opt-in to 1.1.

  • page/ContentSecurityPolicy.h:

Added two new types to the HeaderTypes enum: PrefixedReportOnly, and
PrefixedEnforcePolicy. These map to 'X-WebKitCSP-Report-Only' and
'X-WebKit-CSP', respectively.

LayoutTests:

  • http/tests/security/contentSecurityPolicy/1.1/plugintypes-invalid.html:
  • http/tests/security/contentSecurityPolicy/1.1/plugintypes-url-01.html:
  • http/tests/security/contentSecurityPolicy/1.1/plugintypes-url-02.html:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-invalidnonce.html:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-scriptsrc-blocked.html:
  • http/tests/security/contentSecurityPolicy/1.1/scriptnonce-separators-allowed.html:

Updating these 1.1 tests along with the multiple-iframe-*.js test
"framework" to ensure that the experimental prefixed header is sent.

  • http/tests/security/contentSecurityPolicy/blob-urls-match-self.html:
  • http/tests/security/contentSecurityPolicy/combine-multiple-policies.html:
  • http/tests/security/contentSecurityPolicy/connect-src-eventsource-allowed.html:
  • http/tests/security/contentSecurityPolicy/connect-src-eventsource-blocked.html:
  • http/tests/security/contentSecurityPolicy/connect-src-websocket-allowed.html:
  • http/tests/security/contentSecurityPolicy/connect-src-websocket-blocked.html:
  • http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-allowed.html:
  • http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-blocked.html:
  • http/tests/security/contentSecurityPolicy/default-src-inline-allowed.html:
  • http/tests/security/contentSecurityPolicy/default-src-inline-blocked.html:
  • http/tests/security/contentSecurityPolicy/duplicate-directive.html:
  • http/tests/security/contentSecurityPolicy/eval-allowed.html:
  • http/tests/security/contentSecurityPolicy/eval-blocked-in-about-blank-iframe.html:
  • http/tests/security/contentSecurityPolicy/eval-blocked.html:
  • http/tests/security/contentSecurityPolicy/eval-scripts-setInterval-allowed.html:
  • http/tests/security/contentSecurityPolicy/eval-scripts-setInterval-blocked.html:
  • http/tests/security/contentSecurityPolicy/eval-scripts-setTimeout-allowed.html:
  • http/tests/security/contentSecurityPolicy/eval-scripts-setTimeout-blocked.html:
  • http/tests/security/contentSecurityPolicy/filesystem-urls-match-self.html:
  • http/tests/security/contentSecurityPolicy/frame-src-about-blank-allowed-by-default.html:
  • http/tests/security/contentSecurityPolicy/frame-src-about-blank-allowed-by-scheme.html:
  • http/tests/security/contentSecurityPolicy/frame-src-allowed.html:
  • http/tests/security/contentSecurityPolicy/frame-src-blocked.html:
  • http/tests/security/contentSecurityPolicy/function-constructor-allowed.html:
  • http/tests/security/contentSecurityPolicy/function-constructor-blocked.html:
  • http/tests/security/contentSecurityPolicy/iframe-inside-csp.html:
  • http/tests/security/contentSecurityPolicy/image-allowed.html:
  • http/tests/security/contentSecurityPolicy/image-blocked.html:
  • http/tests/security/contentSecurityPolicy/image-full-host-wildcard-allowed.html:
  • http/tests/security/contentSecurityPolicy/image-host-wildcard-allowed.html:
  • http/tests/security/contentSecurityPolicy/injected-inline-script-allowed.html:
  • http/tests/security/contentSecurityPolicy/injected-inline-script-blocked.html:
  • http/tests/security/contentSecurityPolicy/injected-inline-style-allowed.html:
  • http/tests/security/contentSecurityPolicy/injected-inline-style-blocked.html:
  • http/tests/security/contentSecurityPolicy/inline-script-allowed.html:
  • http/tests/security/contentSecurityPolicy/inline-script-blocked-goofy.html:
  • http/tests/security/contentSecurityPolicy/inline-script-blocked-javascript-url.html:
  • http/tests/security/contentSecurityPolicy/inline-script-blocked.html:
  • http/tests/security/contentSecurityPolicy/inline-style-allowed.html:
  • http/tests/security/contentSecurityPolicy/inline-style-attribute-allowed.html:
  • http/tests/security/contentSecurityPolicy/inline-style-attribute-blocked.html:
  • http/tests/security/contentSecurityPolicy/inline-style-attribute-on-html.html:
  • http/tests/security/contentSecurityPolicy/inline-style-blocked.html:
  • http/tests/security/contentSecurityPolicy/media-src-allowed.html:
  • http/tests/security/contentSecurityPolicy/media-src-blocked.html:
  • http/tests/security/contentSecurityPolicy/object-src-no-url-allowed.html:
  • http/tests/security/contentSecurityPolicy/object-src-no-url-blocked.html:
  • http/tests/security/contentSecurityPolicy/object-src-url-allowed.html:
  • http/tests/security/contentSecurityPolicy/object-src-url-blocked.html:
  • http/tests/security/contentSecurityPolicy/policy-does-not-affect-child.html:
  • http/tests/security/contentSecurityPolicy/register-bypassing-scheme.html:
  • http/tests/security/contentSecurityPolicy/report-and-enforce.html:
  • http/tests/security/contentSecurityPolicy/report-blocked-uri-cross-origin.html:
  • http/tests/security/contentSecurityPolicy/report-blocked-uri.html:
  • http/tests/security/contentSecurityPolicy/report-only-from-header.php:
  • http/tests/security/contentSecurityPolicy/report-only.html:
  • http/tests/security/contentSecurityPolicy/report-uri.html:
  • http/tests/security/contentSecurityPolicy/resources/echo-iframe.pl:
  • http/tests/security/contentSecurityPolicy/resources/echo-multiple-headers.pl:

s/X-WebKit-CSP/Content-Security-Policy/g

  • http/tests/security/contentSecurityPolicy/resources/echo-object-data.pl:
  • http/tests/security/contentSecurityPolicy/resources/echo-script-src.pl:

Reworking these two scripts in order to support sending both
the experimental header and the canonical header, as required.

  • http/tests/security/contentSecurityPolicy/resources/event-handler.pl:
  • http/tests/security/contentSecurityPolicy/resources/generate-csp-report.html:
  • http/tests/security/contentSecurityPolicy/resources/javascript-url.pl:
  • http/tests/security/contentSecurityPolicy/resources/mixed-content-with-csp.html:

s/X-WebKit-CSP/Content-Security-Policy/g

  • http/tests/security/contentSecurityPolicy/resources/multiple-iframe-plugin-test.js:

(testExperimentalPolicy):
(test):
(testImpl.iframe.onload):
(testImpl):

  • http/tests/security/contentSecurityPolicy/resources/multiple-iframe-test.js:

(testPreescapedPolicy):
(testExperimentalPolicy):
(test):
(testImpl.iframe.onload):
(testImpl):

Reworking these two "frameworks" in order to support sending both
the experimental header and the canonical header, as required.

  • http/tests/security/contentSecurityPolicy/resources/sandbox.php:
  • http/tests/security/contentSecurityPolicy/resources/sandboxed-eval.php:
  • http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-subframe.html:
  • http/tests/security/contentSecurityPolicy/sandbox-allow-scripts.html:
  • http/tests/security/contentSecurityPolicy/sandbox-empty-subframe.html:
  • http/tests/security/contentSecurityPolicy/sandbox-empty.html:
  • http/tests/security/contentSecurityPolicy/script-src-overrides-default-src.html:
  • http/tests/security/contentSecurityPolicy/shared-worker-connect-src-allowed.html:
  • http/tests/security/contentSecurityPolicy/shared-worker-connect-src-blocked.html:
  • http/tests/security/contentSecurityPolicy/source-list-parsing-malformed-meta.html:
  • http/tests/security/contentSecurityPolicy/srcdoc-doesnt-bypass-script-src.html:
  • http/tests/security/contentSecurityPolicy/style-allowed.html:
  • http/tests/security/contentSecurityPolicy/style-blocked.html:
  • http/tests/security/contentSecurityPolicy/worker-connect-src-allowed.html:
  • http/tests/security/contentSecurityPolicy/worker-connect-src-blocked.html:
  • http/tests/security/contentSecurityPolicy/worker-eval-blocked.html:
  • http/tests/security/contentSecurityPolicy/worker-function-function-blocked.html:
  • http/tests/security/contentSecurityPolicy/worker-script-src.html:
  • http/tests/security/contentSecurityPolicy/worker-set-timeout-blocked.html:
  • http/tests/security/contentSecurityPolicy/xsl-allowed.php:
  • http/tests/security/contentSecurityPolicy/xsl-blocked.php:
  • http/tests/security/contentSecurityPolicy/xsl-img-blocked.php:
  • http/tests/security/contentSecurityPolicy/xsl-unaffected-by-style-src-1.php:
  • http/tests/security/contentSecurityPolicy/xsl-unaffected-by-style-src-2.php:

s/X-WebKit-CSP/Content-Security-Policy/g

Location:
trunk
Files:
105 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r133094 r133095  
     12012-10-31  Mike West  <mkwst@chromium.org>
     2
     3        Implement the canonical "Content-Security-Policy" header.
     4        https://bugs.webkit.org/show_bug.cgi?id=96765
     5
     6        Reviewed by Adam Barth.
     7
     8        * http/tests/security/contentSecurityPolicy/1.1/plugintypes-invalid.html:
     9        * http/tests/security/contentSecurityPolicy/1.1/plugintypes-url-01.html:
     10        * http/tests/security/contentSecurityPolicy/1.1/plugintypes-url-02.html:
     11        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-invalidnonce.html:
     12        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-scriptsrc-blocked.html:
     13        * http/tests/security/contentSecurityPolicy/1.1/scriptnonce-separators-allowed.html:
     14            Updating these 1.1 tests along with the multiple-iframe-*.js test
     15            "framework" to ensure that the experimental prefixed header is sent.
     16        * http/tests/security/contentSecurityPolicy/blob-urls-match-self.html:
     17        * http/tests/security/contentSecurityPolicy/combine-multiple-policies.html:
     18        * http/tests/security/contentSecurityPolicy/connect-src-eventsource-allowed.html:
     19        * http/tests/security/contentSecurityPolicy/connect-src-eventsource-blocked.html:
     20        * http/tests/security/contentSecurityPolicy/connect-src-websocket-allowed.html:
     21        * http/tests/security/contentSecurityPolicy/connect-src-websocket-blocked.html:
     22        * http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-allowed.html:
     23        * http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-blocked.html:
     24        * http/tests/security/contentSecurityPolicy/default-src-inline-allowed.html:
     25        * http/tests/security/contentSecurityPolicy/default-src-inline-blocked.html:
     26        * http/tests/security/contentSecurityPolicy/duplicate-directive.html:
     27        * http/tests/security/contentSecurityPolicy/eval-allowed.html:
     28        * http/tests/security/contentSecurityPolicy/eval-blocked-in-about-blank-iframe.html:
     29        * http/tests/security/contentSecurityPolicy/eval-blocked.html:
     30        * http/tests/security/contentSecurityPolicy/eval-scripts-setInterval-allowed.html:
     31        * http/tests/security/contentSecurityPolicy/eval-scripts-setInterval-blocked.html:
     32        * http/tests/security/contentSecurityPolicy/eval-scripts-setTimeout-allowed.html:
     33        * http/tests/security/contentSecurityPolicy/eval-scripts-setTimeout-blocked.html:
     34        * http/tests/security/contentSecurityPolicy/filesystem-urls-match-self.html:
     35        * http/tests/security/contentSecurityPolicy/frame-src-about-blank-allowed-by-default.html:
     36        * http/tests/security/contentSecurityPolicy/frame-src-about-blank-allowed-by-scheme.html:
     37        * http/tests/security/contentSecurityPolicy/frame-src-allowed.html:
     38        * http/tests/security/contentSecurityPolicy/frame-src-blocked.html:
     39        * http/tests/security/contentSecurityPolicy/function-constructor-allowed.html:
     40        * http/tests/security/contentSecurityPolicy/function-constructor-blocked.html:
     41        * http/tests/security/contentSecurityPolicy/iframe-inside-csp.html:
     42        * http/tests/security/contentSecurityPolicy/image-allowed.html:
     43        * http/tests/security/contentSecurityPolicy/image-blocked.html:
     44        * http/tests/security/contentSecurityPolicy/image-full-host-wildcard-allowed.html:
     45        * http/tests/security/contentSecurityPolicy/image-host-wildcard-allowed.html:
     46        * http/tests/security/contentSecurityPolicy/injected-inline-script-allowed.html:
     47        * http/tests/security/contentSecurityPolicy/injected-inline-script-blocked.html:
     48        * http/tests/security/contentSecurityPolicy/injected-inline-style-allowed.html:
     49        * http/tests/security/contentSecurityPolicy/injected-inline-style-blocked.html:
     50        * http/tests/security/contentSecurityPolicy/inline-script-allowed.html:
     51        * http/tests/security/contentSecurityPolicy/inline-script-blocked-goofy.html:
     52        * http/tests/security/contentSecurityPolicy/inline-script-blocked-javascript-url.html:
     53        * http/tests/security/contentSecurityPolicy/inline-script-blocked.html:
     54        * http/tests/security/contentSecurityPolicy/inline-style-allowed.html:
     55        * http/tests/security/contentSecurityPolicy/inline-style-attribute-allowed.html:
     56        * http/tests/security/contentSecurityPolicy/inline-style-attribute-blocked.html:
     57        * http/tests/security/contentSecurityPolicy/inline-style-attribute-on-html.html:
     58        * http/tests/security/contentSecurityPolicy/inline-style-blocked.html:
     59        * http/tests/security/contentSecurityPolicy/media-src-allowed.html:
     60        * http/tests/security/contentSecurityPolicy/media-src-blocked.html:
     61        * http/tests/security/contentSecurityPolicy/object-src-no-url-allowed.html:
     62        * http/tests/security/contentSecurityPolicy/object-src-no-url-blocked.html:
     63        * http/tests/security/contentSecurityPolicy/object-src-url-allowed.html:
     64        * http/tests/security/contentSecurityPolicy/object-src-url-blocked.html:
     65        * http/tests/security/contentSecurityPolicy/policy-does-not-affect-child.html:
     66        * http/tests/security/contentSecurityPolicy/register-bypassing-scheme.html:
     67        * http/tests/security/contentSecurityPolicy/report-and-enforce.html:
     68        * http/tests/security/contentSecurityPolicy/report-blocked-uri-cross-origin.html:
     69        * http/tests/security/contentSecurityPolicy/report-blocked-uri.html:
     70        * http/tests/security/contentSecurityPolicy/report-only-from-header.php:
     71        * http/tests/security/contentSecurityPolicy/report-only.html:
     72        * http/tests/security/contentSecurityPolicy/report-uri.html:
     73        * http/tests/security/contentSecurityPolicy/resources/echo-iframe.pl:
     74        * http/tests/security/contentSecurityPolicy/resources/echo-multiple-headers.pl:
     75            s/X-WebKit-CSP/Content-Security-Policy/g
     76        * http/tests/security/contentSecurityPolicy/resources/echo-object-data.pl:
     77        * http/tests/security/contentSecurityPolicy/resources/echo-script-src.pl:
     78            Reworking these two scripts in order to support sending both
     79            the experimental header and the canonical header, as required.
     80        * http/tests/security/contentSecurityPolicy/resources/event-handler.pl:
     81        * http/tests/security/contentSecurityPolicy/resources/generate-csp-report.html:
     82        * http/tests/security/contentSecurityPolicy/resources/javascript-url.pl:
     83        * http/tests/security/contentSecurityPolicy/resources/mixed-content-with-csp.html:
     84            s/X-WebKit-CSP/Content-Security-Policy/g
     85        * http/tests/security/contentSecurityPolicy/resources/multiple-iframe-plugin-test.js:
     86        (testExperimentalPolicy):
     87        (test):
     88        (testImpl.iframe.onload):
     89        (testImpl):
     90        * http/tests/security/contentSecurityPolicy/resources/multiple-iframe-test.js:
     91        (testPreescapedPolicy):
     92        (testExperimentalPolicy):
     93        (test):
     94        (testImpl.iframe.onload):
     95        (testImpl):
     96            Reworking these two "frameworks" in order to support sending both
     97            the experimental header and the canonical header, as required.
     98        * http/tests/security/contentSecurityPolicy/resources/sandbox.php:
     99        * http/tests/security/contentSecurityPolicy/resources/sandboxed-eval.php:
     100        * http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-subframe.html:
     101        * http/tests/security/contentSecurityPolicy/sandbox-allow-scripts.html:
     102        * http/tests/security/contentSecurityPolicy/sandbox-empty-subframe.html:
     103        * http/tests/security/contentSecurityPolicy/sandbox-empty.html:
     104        * http/tests/security/contentSecurityPolicy/script-src-overrides-default-src.html:
     105        * http/tests/security/contentSecurityPolicy/shared-worker-connect-src-allowed.html:
     106        * http/tests/security/contentSecurityPolicy/shared-worker-connect-src-blocked.html:
     107        * http/tests/security/contentSecurityPolicy/source-list-parsing-malformed-meta.html:
     108        * http/tests/security/contentSecurityPolicy/srcdoc-doesnt-bypass-script-src.html:
     109        * http/tests/security/contentSecurityPolicy/style-allowed.html:
     110        * http/tests/security/contentSecurityPolicy/style-blocked.html:
     111        * http/tests/security/contentSecurityPolicy/worker-connect-src-allowed.html:
     112        * http/tests/security/contentSecurityPolicy/worker-connect-src-blocked.html:
     113        * http/tests/security/contentSecurityPolicy/worker-eval-blocked.html:
     114        * http/tests/security/contentSecurityPolicy/worker-function-function-blocked.html:
     115        * http/tests/security/contentSecurityPolicy/worker-script-src.html:
     116        * http/tests/security/contentSecurityPolicy/worker-set-timeout-blocked.html:
     117        * http/tests/security/contentSecurityPolicy/xsl-allowed.php:
     118        * http/tests/security/contentSecurityPolicy/xsl-blocked.php:
     119        * http/tests/security/contentSecurityPolicy/xsl-img-blocked.php:
     120        * http/tests/security/contentSecurityPolicy/xsl-unaffected-by-style-src-1.php:
     121        * http/tests/security/contentSecurityPolicy/xsl-unaffected-by-style-src-2.php:
     122            s/X-WebKit-CSP/Content-Security-Policy/g
     123
    11242012-10-31  Otto Derek Cheung  <otcheung@rim.com>
    2125

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/plugintypes-invalid.html

    r125531 r133095  
    1616</script>
    1717</head>
    18 <body onload="test()">
     18<body onload="testExperimentalPolicy()">
    1919    <p>
    2020        This tests our handling of invalid `plugin-types` CSP directives.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/plugintypes-url-01.html

    r125531 r133095  
    1212</script>
    1313</head>
    14 <body onload="test()">
     14<body onload="testExperimentalPolicy()">
    1515    <p>
    1616        This tests our handling of `data:` URLs, given a `plugin-types` CSP

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/plugintypes-url-02.html

    r125531 r133095  
    1111</script>
    1212</head>
    13 <body onload="test()">
     13<body onload="testExperimentalPolicy()">
    1414    <p>
    1515        This tests our handling of non-`data:` URLs, given a `plugin-types` CSP

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-invalidnonce.html

    r122741 r133095  
    1212</script>
    1313</head>
    14 <body onload="test()">
     14<body onload="testExperimentalPolicy()">
    1515  <p>
    1616      None of these scripts should execute, as all the nonces are invalid.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-scriptsrc-blocked.html

    r121883 r133095  
    1212</script>
    1313</head>
    14 <body onload="test()">
     14<body onload="testExperimentalPolicy()">
    1515  <p>
    1616    None of these scripts should execute even though there are parse errors in the policy.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scriptnonce-separators-allowed.html

    r125614 r133095  
    1111</script>
    1212</head>
    13 <body onload="test()">
     13<body onload="testExperimentalPolicy()">
    1414  <p>
    1515      All of these scripts should execute, as all the nonces are valid.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/blob-urls-match-self.html

    r126785 r133095  
    22<html>
    33    <head>
    4         <meta http-equiv="X-WebKit-CSP" content="script-src 'unsafe-inline' 'self'">
     4        <meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline' 'self'">
    55    </head>
    66    <body>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/combine-multiple-policies.html

    r116254 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="script-src 'self'">
    5 <meta http-equiv="X-WebKit-CSP" content="style-src 'none'">
     4<meta http-equiv="Content-Security-Policy" content="script-src 'self'">
     5<meta http-equiv="Content-Security-Policy" content="style-src 'none'">
    66<script src="resources/dump-as-text.js"></script>
    77</head>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-eventsource-allowed.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="connect-src http://127.0.0.1:8000">
     4<meta http-equiv="Content-Security-Policy" content="connect-src http://127.0.0.1:8000">
    55<script>
    66if (window.testRunner)

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-eventsource-blocked.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="connect-src http://localhost:8000">
     4<meta http-equiv="Content-Security-Policy" content="connect-src http://localhost:8000">
    55<script>
    66if (window.testRunner)

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-websocket-allowed.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="connect-src ws://127.0.0.1:8880">
     4<meta http-equiv="Content-Security-Policy" content="connect-src ws://127.0.0.1:8880">
    55<script>
    66if (window.testRunner)

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-websocket-blocked.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="connect-src ws://127.0.0.1:8880">
     4<meta http-equiv="Content-Security-Policy" content="connect-src ws://127.0.0.1:8880">
    55<script>
    66if (window.testRunner)

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-allowed.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="connect-src http://127.0.0.1:8000">
     4<meta http-equiv="Content-Security-Policy" content="connect-src http://127.0.0.1:8000">
    55<script>
    66if (window.testRunner)

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/connect-src-xmlhttprequest-blocked.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="connect-src http://127.0.0.1:8000">
     4<meta http-equiv="Content-Security-Policy" content="connect-src http://127.0.0.1:8000">
    55<script>
    66if (window.testRunner)

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/default-src-inline-allowed.html

    r85451 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="default-src 'self' about: 'unsafe-inline'">
     4<meta http-equiv="Content-Security-Policy" content="default-src 'self' about: 'unsafe-inline'">
    55<script src="resources/dump-as-text.js"></script>
    66</head>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/default-src-inline-blocked.html

    r85451 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="default-src 'self'">
     4<meta http-equiv="Content-Security-Policy" content="default-src 'self'">
    55<script src="resources/dump-as-text.js"></script>
    66</head>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/duplicate-directive.html

    r120174 r133095  
    22<html>
    33    <head>
    4         <meta http-equiv="X-WebKit-CSP" content="script-src 'unsafe-inline'; script-src 'none'">
     4        <meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline'; script-src 'none'">
    55        <script>
    66        if (window.testRunner) {

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/eval-allowed.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="script-src 'unsafe-inline' 'unsafe-eval'">
     4<meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline' 'unsafe-eval'">
    55<script>
    66if (window.testRunner)

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/eval-blocked-in-about-blank-iframe.html

    r120174 r133095  
    33    testRunner.dumpAsText();
    44</script>
    5 <meta http-equiv="X-WebKit-CSP" content="script-src 'unsafe-inline'">
     5<meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline'">
    66<iframe src="about:blank"></iframe>
    77Eval should be blocked in the iframe, but inline script should be allowed.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/eval-blocked.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="script-src 'unsafe-inline'">
     4<meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline'">
    55<script>
    66if (window.testRunner)

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/eval-scripts-setInterval-allowed.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="script-src 'unsafe-inline' 'unsafe-eval'">
     4<meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline' 'unsafe-eval'">
    55</head>
    66<pre>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/eval-scripts-setInterval-blocked.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="script-src 'unsafe-inline'">
     4<meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline'">
    55</head>
    66<pre>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/eval-scripts-setTimeout-allowed.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="script-src 'unsafe-inline' 'unsafe-eval'">
     4<meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline' 'unsafe-eval'">
    55</head>
    66<pre>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/eval-scripts-setTimeout-blocked.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="script-src 'unsafe-inline'">
     4<meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline'">
    55</head>
    66<pre>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/filesystem-urls-match-self.html

    r126785 r133095  
    22<html>
    33    <head>
    4         <meta http-equiv="X-WebKit-CSP" content="script-src 'unsafe-inline' 'self'">
     4        <meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline' 'self'">
    55    </head>
    66    <body>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/frame-src-about-blank-allowed-by-default.html

    r120174 r133095  
    33    testRunner.dumpAsText();
    44</script>
    5 <meta http-equiv="X-WebKit-CSP" content="frame-src 'none'; object-src 'none'">
     5<meta http-equiv="Content-Security-Policy" content="frame-src 'none'; object-src 'none'">
    66These frames should not be blocked by Content-Security-Policy.  It's pointless
    77to block about:blank iframes because blocking a frame just results in

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/frame-src-about-blank-allowed-by-scheme.html

    r120174 r133095  
    33    testRunner.dumpAsText();
    44</script>
    5 <meta http-equiv="X-WebKit-CSP" content="frame-src about:">
     5<meta http-equiv="Content-Security-Policy" content="frame-src about:">
    66This iframe should not be blocked by Content-Security-Policy:
    77<iframe src="about:blank"></iframe>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/frame-src-allowed.html

    r84460 r133095  
    1 <meta http-equiv="X-WebKit-CSP" content="frame-src 'self'">
     1<meta http-equiv="Content-Security-Policy" content="frame-src 'self'">
    22<script src="resources/dump-as-text.js"></script>
    33<iframe src="resources/alert-pass.html"></iframe>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/frame-src-blocked.html

    r84460 r133095  
    1 <meta http-equiv="X-WebKit-CSP" content="frame-src 'none'">
     1<meta http-equiv="Content-Security-Policy" content="frame-src 'none'">
    22<script src="resources/dump-as-text.js"></script>
    33<iframe src="resources/alert-fail.html"></iframe>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/function-constructor-allowed.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="script-src 'unsafe-inline' 'unsafe-eval'">
     4<meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline' 'unsafe-eval'">
    55<script>
    66if (window.testRunner)

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/function-constructor-blocked.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="script-src 'unsafe-inline'">
     4<meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline'">
    55<script>
    66if (window.testRunner)

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/iframe-inside-csp.html

    r119913 r133095  
    1 <meta http-equiv="X-WebKit-CSP" content="script-src 'self'">
     1<meta http-equiv="Content-Security-Policy" content="script-src 'self'">
    22<script src="resources/dump-as-text.js"></script>
    33<iframe src="resources/sandboxed-eval.php"></iframe>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/image-allowed.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="img-src *; script-src 'unsafe-inline'">
     4<meta http-equiv="Content-Security-Policy" content="img-src *; script-src 'unsafe-inline'">
    55<script>
    66if (window.testRunner)

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/image-blocked.html

    r126194 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="img-src 'none'; script-src 'unsafe-inline'">
     4<meta http-equiv="Content-Security-Policy" content="img-src 'none'; script-src 'unsafe-inline'">
    55<script>
    66if (window.testRunner)

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/image-full-host-wildcard-allowed.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="img-src *.127.0.0.1:8000; script-src 'unsafe-inline'">
     4<meta http-equiv="Content-Security-Policy" content="img-src *.127.0.0.1:8000; script-src 'unsafe-inline'">
    55<script>
    66if (window.testRunner)

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/image-host-wildcard-allowed.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="img-src *.0.1:8000; script-src 'unsafe-inline'">
     4<meta http-equiv="Content-Security-Policy" content="img-src *.0.1:8000; script-src 'unsafe-inline'">
    55<script>
    66if (window.testRunner)

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/injected-inline-script-allowed.html

    r118585 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="script-src http://127.0.0.1:* 'unsafe-inline'">
     4<meta http-equiv="Content-Security-Policy" content="script-src http://127.0.0.1:* 'unsafe-inline'">
    55<script src="resources/dump-as-text.js"></script>
    66</head>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/injected-inline-script-blocked.html

    r118585 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="script-src http://127.0.0.1:*">
     4<meta http-equiv="Content-Security-Policy" content="script-src http://127.0.0.1:*">
    55<script src="resources/dump-as-text.js"></script>
    66</head>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/injected-inline-style-allowed.html

    r118585 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="style-src 'unsafe-inline'">
     4<meta http-equiv="Content-Security-Policy" content="style-src 'unsafe-inline'">
    55<script src="resources/dump-as-text.js"></script>
    66</head>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/injected-inline-style-blocked.html

    r118585 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="style-src 'none'">
     4<meta http-equiv="Content-Security-Policy" content="style-src 'none'">
    55<script src="resources/dump-as-text.js"></script>
    66</head>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/inline-script-allowed.html

    r84758 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="script-src http://127.0.0.1:* 'unsafe-inline'">
     4<meta http-equiv="Content-Security-Policy" content="script-src http://127.0.0.1:* 'unsafe-inline'">
    55<script src="resources/dump-as-text.js"></script>
    66</head>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/inline-script-blocked-goofy.html

    r84457 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="script-src http://127.0.0.1:*; options goofy">
     4<meta http-equiv="Content-Security-Policy" content="script-src http://127.0.0.1:*; options goofy">
    55<script src="resources/dump-as-text.js"></script>
    66</head>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/inline-script-blocked-javascript-url.html

    r84457 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="script-src http://127.0.0.1:*; options goofy">
     4<meta http-equiv="Content-Security-Policy" content="script-src http://127.0.0.1:*; options goofy">
    55<script src="resources/dump-as-text.js"></script>
    66</head>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/inline-script-blocked.html

    r83159 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="script-src http://127.0.0.1:*">
     4<meta http-equiv="Content-Security-Policy" content="script-src http://127.0.0.1:*">
    55<script src="resources/dump-as-text.js"></script>
    66</head>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/inline-style-allowed.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="style-src 'unsafe-inline'; script-src 'unsafe-inline'">
     4<meta http-equiv="Content-Security-Policy" content="style-src 'unsafe-inline'; script-src 'unsafe-inline'">
    55<style>
    66.target {

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/inline-style-attribute-allowed.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="style-src 'unsafe-inline'; script-src 'unsafe-inline'">
     4<meta http-equiv="Content-Security-Policy" content="style-src 'unsafe-inline'; script-src 'unsafe-inline'">
    55<script>
    66if (window.testRunner)

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/inline-style-attribute-blocked.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="style-src 'none'; script-src 'unsafe-inline'">
     4<meta http-equiv="Content-Security-Policy" content="style-src 'none'; script-src 'unsafe-inline'">
    55<script>
    66if (window.testRunner)

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/inline-style-attribute-on-html.html

    r120174 r133095  
    22<html style="background-color: blue;">
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="style-src 'none'; script-src 'unsafe-inline'">
     4<meta http-equiv="Content-Security-Policy" content="style-src 'none'; script-src 'unsafe-inline'">
    55<script>
    66if (window.testRunner)

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/inline-style-blocked.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="style-src 'none'; script-src 'unsafe-inline'">
     4<meta http-equiv="Content-Security-Policy" content="style-src 'none'; script-src 'unsafe-inline'">
    55<style>
    66.target {

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/media-src-allowed.html

    r124920 r133095  
    1 <meta http-equiv="X-WebKit-CSP" content="media-src http://127.0.0.1:8000">
     1<meta http-equiv="Content-Security-Policy" content="media-src http://127.0.0.1:8000">
    22<video></video>
    33<script src=../../../media-resources/media-file.js></script>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/media-src-blocked.html

    r124920 r133095  
    1 <meta http-equiv="X-WebKit-CSP" content="media-src 'none'">
     1<meta http-equiv="Content-Security-Policy" content="media-src 'none'">
    22<video></video>
    33<script src=../../../media-resources/media-file.js></script>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/object-src-no-url-allowed.html

    r120174 r133095  
    66  testRunner.dumpAsText();
    77</script>
    8 <meta http-equiv="X-WebKit-CSP" content="object-src 'self'">
     8<meta http-equiv="Content-Security-Policy" content="object-src 'self'">
    99</head>
    1010<body>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/object-src-no-url-blocked.html

    r120174 r133095  
    66  testRunner.dumpAsText();
    77</script>
    8 <meta http-equiv="X-WebKit-CSP" content="object-src 'none'">
     8<meta http-equiv="Content-Security-Policy" content="object-src 'none'">
    99</head>
    1010<body>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/object-src-url-allowed.html

    r124371 r133095  
    66    testRunner.dumpAsText();
    77</script>
    8 <meta http-equiv="X-WebKit-CSP" content="object-src 'self'">
     8<meta http-equiv="Content-Security-Policy" content="object-src 'self'">
    99</head>
    1010<body>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/object-src-url-blocked.html

    r124371 r133095  
    66    testRunner.dumpAsText();
    77</script>
    8 <meta http-equiv="X-WebKit-CSP" content="object-src 'none'">
     8<meta http-equiv="Content-Security-Policy" content="object-src 'none'">
    99</head>
    1010<body>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/policy-does-not-affect-child.html

    r84478 r133095  
    1 <meta http-equiv="X-WebKit-CSP" content="script-src 'self'">
     1<meta http-equiv="Content-Security-Policy" content="script-src 'self'">
    22<script src="resources/dump-as-text.js"></script>
    33<iframe src="resources/alert-pass.html"></iframe>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/register-bypassing-scheme.html

    r126194 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="img-src https:; script-src 'unsafe-inline'">
     4<meta http-equiv="Content-Security-Policy" content="img-src https:; script-src 'unsafe-inline'">
    55<script>
    66    if (window.testRunner) {

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/report-and-enforce.html

    r116254 r133095  
    1 <meta http-equiv="X-WebKit-CSP" content="img-src 'none'">
    2 <meta http-equiv="X-WebKit-CSP-Report-Only" content="script-src 'self'; report-uri resources/save-report.php">
     1<meta http-equiv="Content-Security-Policy" content="img-src 'none'">
     2<meta http-equiv="Content-Security-Policy-Report-Only" content="script-src 'self'; report-uri resources/save-report.php">
    33<script>
    44// This script block will trigger a violation report but shouldn't be blocked.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/report-blocked-uri-cross-origin.html

    r116274 r133095  
    1 <meta http-equiv="X-WebKit-CSP-Report-Only" content="img-src 'none'; report-uri resources/save-report.php">
     1<meta http-equiv="Content-Security-Policy-Report-Only" content="img-src 'none'; report-uri resources/save-report.php">
    22The origin of this image should show up in the violation report.
    33<img src="http://localhost:8080/security/resources/abe.png">

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/report-blocked-uri.html

    r116274 r133095  
    1 <meta http-equiv="X-WebKit-CSP-Report-Only" content="img-src 'none'; report-uri resources/save-report.php">
     1<meta http-equiv="Content-Security-Policy-Report-Only" content="img-src 'none'; report-uri resources/save-report.php">
    22The URI of this image should show up in the violation report.
    33<img src="../resources/abe.png#the-fragment-should-not-be-in-report">

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/report-only-from-header.php

    r100574 r133095  
    11<?php
    2 header("X-WebKit-CSP-Report-Only: script-src 'self'; report-uri resources/save-report.php");
     2header("Content-Security-Policy-Report-Only: script-src 'self'; report-uri resources/save-report.php");
    33?>
    44<script>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/report-only.html

    r85993 r133095  
    1 <meta http-equiv="X-WebKit-CSP-Report-Only" content="script-src 'self'; report-uri resources/save-report.php">
     1<meta http-equiv="Content-Security-Policy-Report-Only" content="script-src 'self'; report-uri resources/save-report.php">
    22<script>
    33// This script block will trigger a violation report but shouldn't be blocked.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/report-uri.html

    r84478 r133095  
    1 <meta http-equiv="X-WebKit-CSP" content="script-src 'self'; report-uri resources/save-report.php">
     1<meta http-equiv="Content-Security-Policy" content="script-src 'self'; report-uri resources/save-report.php">
    22<script>
    33// This script block will trigger a violation report.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/resources/echo-iframe.pl

    r78058 r133095  
    66
    77print "Content-Type: text/html; charset=UTF-8\n";
    8 print "X-WebKit-CSP: ".$cgi->param('csp')."\n\n";
     8print "Content-Security-Policy: ".$cgi->param('csp')."\n\n";
    99
    1010print "<!DOCTYPE html>\n";

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/resources/echo-multiple-headers.pl

    r121936 r133095  
    66
    77print "Content-Type: text/html; charset=UTF-8\n";
    8 print "X-WebKit-CSP: ".$cgi->param('csp1')."\n";
    9 print "X-WebKit-CSP: ".$cgi->param('csp2')."\n\n";
     8print "Content-Security-Policy: ".$cgi->param('csp1')."\n";
     9print "Content-Security-Policy: ".$cgi->param('csp2')."\n\n";
    1010
    1111my ($text, $replacement) = ("FAIL", "PASS");

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/resources/echo-object-data.pl

    r125531 r133095  
    66
    77print "Content-Type: text/html; charset=UTF-8\n";
    8 print "X-WebKit-CSP: ".$cgi->param('csp')."\n\n";
     8if ($cgi->param('experimental') eq 'true') {
     9    print "X-WebKit-CSP: ".$cgi->param('csp')."\n\n";
     10} else {
     11    print "Content-Security-Policy: ".$cgi->param('csp')."\n\n";
     12}
    913
    1014print "<!DOCTYPE html>\n";

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/resources/echo-script-src.pl

    r121883 r133095  
    66
    77print "Content-Type: text/html; charset=UTF-8\n";
    8 print "X-WebKit-CSP: ".$cgi->param('csp')."\n\n";
     8if ($cgi->param('experimental') eq 'true') {
     9    print "X-WebKit-CSP: ".$cgi->param('csp')."\n\n";
     10} else {
     11    print "Content-Security-Policy: ".$cgi->param('csp')."\n\n";
     12}
    913
    1014my ($text, $replacement) = ("FAIL", "PASS");

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/resources/event-handler.pl

    r82147 r133095  
    66
    77print "Content-Type: text/html; charset=UTF-8\n";
    8 print "X-WebKit-CSP: ".$cgi->param('csp')."\n\n";
     8print "Content-Security-Policy: ".$cgi->param('csp')."\n\n";
    99
    1010my ($text, $replacement) = ("FAIL", "PASS");

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/resources/generate-csp-report.html

    r84478 r133095  
    1 <meta http-equiv="X-WebKit-CSP" content="script-src 'self'; report-uri save-report.php">
     1<meta http-equiv="Content-Security-Policy" content="script-src 'self'; report-uri save-report.php">
    22<script>
    33// This script block will trigger a violation report.

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/resources/javascript-url.pl

    r79547 r133095  
    66
    77print "Content-Type: text/html; charset=UTF-8\n";
    8 print "X-WebKit-CSP: ".$cgi->param('csp')."\n\n";
     8print "Content-Security-Policy: ".$cgi->param('csp')."\n\n";
    99
    1010my $text = "PASS";

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/resources/mixed-content-with-csp.html

    r99329 r133095  
    1 <meta http-equiv="X-WebKit-CSP" content="default-src 'self'">
     1<meta http-equiv="Content-Security-Policy" content="default-src 'self'">
    22This page includes an insecure script that alerts "FAIL", but that script is blocked by CSP.
    33<script src="http://127.0.0.1:8080/security/contentSecurityPolicy/resources/alert-fail.js"></script>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/resources/multiple-iframe-plugin-test.js

    r125531 r133095  
    55}
    66
     7function testExperimentalPolicy() {
     8    testImpl(true);
     9}
     10
    711function test() {
     12    testImpl(false);
     13}
     14
     15function testImpl(experimental) {
    816    if (tests.length === 0)
    917        return finishTesting();
    10     var baseURL = "http://127.0.0.1:8000/security/contentSecurityPolicy/";
     18    var baseURL = "/security/contentSecurityPolicy/";
    1119    var current = tests.shift();
    1220    var iframe = document.createElement("iframe");
    1321    iframe.src = baseURL + "resources/echo-object-data.pl?" +
     22                 "experimental=" + (experimental ? "true" : "false") +
    1423                 "&csp=" + escape(current[1]);
    1524
    … …  
    3039        iframe.src += "&type=application/x-webkit-test-netscape";
    3140
    32     iframe.onload = test;
     41    iframe.onload = function() { testImpl(experimental); };
    3342    document.body.appendChild(iframe);
    3443}

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/resources/multiple-iframe-test.js

    r128042 r133095  
    66
    77function testPreescapedPolicy() {
    8     testImpl(true);
     8    testImpl(false, true);
     9}
     10
     11function testExperimentalPolicy() {
     12    testImpl(true, false);
    913}
    1014
    1115function test() {
    12     testImpl(false);
     16    testImpl(false, false);
    1317}
    1418
    15 function testImpl(preescapedPolicy) {
     19function testImpl(experimental, preescapedPolicy) {
    1620    if (tests.length === 0)
    1721        return finishTesting();
    1822
    19     var baseURL = "http://127.0.0.1:8000/security/contentSecurityPolicy/";
     23    var baseURL = "/security/contentSecurityPolicy/";
    2024    var current = tests.shift();
    2125    var iframe = document.createElement("iframe");
    … …  
    3034
    3135    iframe.src = baseURL + "resources/echo-script-src.pl?" +
    32                  "should_run=" + encodeURIComponent(current[0]) +
     36                 "experimental=" + (experimental ? "true" : "false") +
     37                 "&should_run=" + encodeURIComponent(current[0]) +
    3338                 "&csp=" + policy + "&q=" + scriptToLoad;
    3439    if (current[3])
    3540      iframe.src += "&nonce=" + encodeURIComponent(current[3]);
    3641
    37     iframe.onload = test;
     42    iframe.onload = function() { testImpl(experimental, preescapedPolicy); };
    3843    document.body.appendChild(iframe);
    3944}

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/resources/sandbox.php

    r119204 r133095  
    11<?php
    2 header("X-WebKit-CSP: sandbox " . $_GET["sandbox"]);
     2header("Content-Security-Policy: sandbox " . $_GET["sandbox"]);
    33?>
    44<!DOCTYPE html>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/resources/sandboxed-eval.php

    r119913 r133095  
    11<?php
    2 header("X-WebKit-CSP: sandbox allow-scripts");
     2header("Content-Security-Policy: sandbox allow-scripts");
    33?>
    44<script>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts-subframe.html

    r120174 r133095  
    33    testRunner.dumpAsText();
    44</script>
    5 <meta http-equiv="X-WebKit-CSP" content="sandbox allow-scripts">
     5<meta http-equiv="Content-Security-Policy" content="sandbox allow-scripts">
    66This test passes if it does alert pass.
    77<iframe src="data:text/html,<script>alert('PASS');</script>"></iframe>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-allow-scripts.html

    r120174 r133095  
    33    testRunner.dumpAsText();
    44</script>
    5 <meta http-equiv="X-WebKit-CSP" content="sandbox allow-scripts">
     5<meta http-equiv="Content-Security-Policy" content="sandbox allow-scripts">
    66This test passes if it does alert pass.
    77<script>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-empty-subframe.html

    r120174 r133095  
    33    testRunner.dumpAsText();
    44</script>
    5 <meta http-equiv="X-WebKit-CSP" content="sandbox">
     5<meta http-equiv="Content-Security-Policy" content="sandbox">
    66This test passes if it doesn't alert fail.
    77<iframe src="data:text/html,<script>alert('FAIL');</script>"></iframe>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/sandbox-empty.html

    r120174 r133095  
    33    testRunner.dumpAsText();
    44</script>
    5 <meta http-equiv="X-WebKit-CSP" content="sandbox">
     5<meta http-equiv="Content-Security-Policy" content="sandbox">
    66This test passes if it doesn't alert fail.
    77<script>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/script-src-overrides-default-src.html

    r85451 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="default-src about:; script-src 'self' 'unsafe-inline'">
     4<meta http-equiv="Content-Security-Policy" content="default-src about:; script-src 'self' 'unsafe-inline'">
    55<script src="resources/dump-as-text.js"></script>
    66</head>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/shared-worker-connect-src-allowed.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="connect-src http://127.0.0.1:8000"/>
     4<meta http-equiv="Content-Security-Policy" content="connect-src http://127.0.0.1:8000"/>
    55<script>
    66if (window.testRunner) {

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/shared-worker-connect-src-blocked.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="connect-src 'none'"/>
     4<meta http-equiv="Content-Security-Policy" content="connect-src 'none'"/>
    55<script>
    66if (window.testRunner) {

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-malformed-meta.html

    r120617 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="connect-src http://localhost:8000"<script>
     4<meta http-equiv="Content-Security-Policy" content="connect-src http://localhost:8000"<script>
    55<script>
    66if (window.testRunner)

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/srcdoc-doesnt-bypass-script-src.html

    r116335 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="script-src 'self'">
     4<meta http-equiv="Content-Security-Policy" content="script-src 'self'">
    55<script src="resources/dump-as-text.js"></script>
    66</head>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/style-allowed.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="style-src *; script-src 'unsafe-inline'">
     4<meta http-equiv="Content-Security-Policy" content="style-src *; script-src 'unsafe-inline'">
    55<link rel="stylesheet" href="resources/blue.css">
    66<script>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/style-blocked.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="style-src 'none'; script-src 'unsafe-inline'">
     4<meta http-equiv="Content-Security-Policy" content="style-src 'none'; script-src 'unsafe-inline'">
    55<link rel="stylesheet" href="resources/blue.css">
    66<script>

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/worker-connect-src-allowed.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="connect-src http://127.0.0.1:8000"/>
     4<meta http-equiv="Content-Security-Policy" content="connect-src http://127.0.0.1:8000"/>
    55<script>
    66if (window.testRunner) {

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/worker-connect-src-blocked.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="connect-src 'none'"/>
     4<meta http-equiv="Content-Security-Policy" content="connect-src 'none'"/>
    55<script>
    66if (window.testRunner) {

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/worker-eval-blocked.html

    r126947 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="script-src 'self' 'unsafe-inline'"/>
     4<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'"/>
    55<script>
    66if (window.testRunner) {

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/worker-function-function-blocked.html

    r126947 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="script-src 'self' 'unsafe-inline'"/>
     4<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'"/>
    55<script>
    66if (window.testRunner) {

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/worker-script-src.html

    r120174 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="script-src 'unsafe-inline'"/>
     4<meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline'"/>
    55<script>
    66if (window.testRunner) {

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/worker-set-timeout-blocked.html

    r125120 r133095  
    22<html>
    33<head>
    4 <meta http-equiv="X-WebKit-CSP" content="script-src 'self' 'unsafe-inline'"/>
     4<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'"/>
    55<script>
    66if (window.testRunner) {

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/xsl-allowed.php

    r120174 r133095  
    11<?php
    22header("Content-Type: application/xhtml+xml");
    3 header("X-WebKit-CSP: script-src * 'unsafe-inline'");
     3header("Content-Security-Policy: script-src * 'unsafe-inline'");
    44
    55echo '<?xml version="1.0" encoding="UTF-8"?>';

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/xsl-blocked.php

    r120174 r133095  
    11<?php
    22header("Content-Type: application/xhtml+xml");
    3 header("X-WebKit-CSP: script-src 'unsafe-inline'");
     3header("Content-Security-Policy: script-src 'unsafe-inline'");
    44
    55echo '<?xml version="1.0" encoding="UTF-8"?>';

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/xsl-img-blocked.php

    r103617 r133095  
    11<?php
    22header("Content-Type: text/xml");
    3 header("X-WebKit-CSP: img-src 'none'");
     3header("Content-Security-Policy: img-src 'none'");
    44
    55echo '<?xml version="1.0" encoding="UTF-8"?>';

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/xsl-unaffected-by-style-src-1.php

    r120174 r133095  
    11<?php
    22header("Content-Type: application/xhtml+xml");
    3 header("X-WebKit-CSP: style-src *; script-src 'unsafe-inline'");
     3header("Content-Security-Policy: style-src *; script-src 'unsafe-inline'");
    44
    55echo '<?xml version="1.0" encoding="UTF-8"?>';

  • trunk/LayoutTests/http/tests/security/contentSecurityPolicy/xsl-unaffected-by-style-src-2.php

    r120174 r133095  
    11<?php
    22header("Content-Type: application/xhtml+xml");
    3 header("X-WebKit-CSP: style-src 'none'; script-src * 'unsafe-inline'");
     3header("Content-Security-Policy: style-src 'none'; script-src * 'unsafe-inline'");
    44
    55echo '<?xml version="1.0" encoding="UTF-8"?>';

  • trunk/Source/WebCore/ChangeLog

    r133092 r133095  
     12012-10-31  Mike West  <mkwst@chromium.org>
     2
     3        Implement the canonical "Content-Security-Policy" header.
     4        https://bugs.webkit.org/show_bug.cgi?id=96765
     5
     6        Reviewed by Adam Barth.
     7
     8        The CSP 1.0 specification defines the "Content-Security-Policy" header
     9        as the canonical mechanism of defining a resource's security policy. Up
     10        through this patch, we've implemented the functionality behind a prefix
     11        in order to ensure compatibility with the standard once it's released as
     12        a recommendation. Both the specification and WebKit's implementation are
     13        far enough along in that process that it makes sense to support the
     14        unprefixed header for sites that wish to opt-in to CSP 1.0.
     15
     16        As discussed on public-webappsec[1], we'll keep the experimental 1.1
     17        features behind the prefixed header ('X-WebKit-CSP') until that standard
     18        is far enough along to justify moving them out to the canonical header.
     19
     20        This patch defines the 'Content-Security-Policy' header for all ports,
     21        just as the 'X-WebKit-CSP' header is currently supported on all ports.
     22        Ports that have not opted-in to the CSP_NEXT flag will see exactly the
     23        same behavior with both headers. Ports that have opted-in will see much
     24        of CSP 1.1's current definition on the prefixed header, and CSP 1.0 on
     25        the canonical header.
     26
     27        The functionality in this change is covered by the changes made to
     28        existing tests. No expectations changed, only the headers that are sent.
     29
     30        * dom/Document.cpp:
     31        (WebCore::Document::processHttpEquiv):
     32            Add canonical header support to 'meta' element definitions.
     33        * loader/FrameLoader.cpp:
     34        (WebCore::FrameLoader::didBeginDocument):
     35            Add canonical header support to FrameLoader.
     36        * page/ContentSecurityPolicy.cpp:
     37        (WebCore::CSPDirectiveList::headerType):
     38            The ContentSecurityPolicy::HeaderType enum now has four values:
     39            prefixed/report-only, unprefixed/report-only, prefixed/enforce, and
     40            unprefixed/enforce. Instead of creating logic to output the proper
     41            type based on internal flags, CSPDirectiveList now saves the value
     42            provided at creation time, and returns it via this method.
     43        (CSPDirectiveList):
     44        (WebCore::CSPDirectiveList::CSPDirectiveList):
     45            The constructor now accepts a type, which is stored on the object.
     46            It also stores a new internal variable, 'm_experimental', which
     47            defines whether or not experimental features ought to be available.
     48            These features are still locked behind the CSP_NEXT flag, but that
     49            might not be the case forever.
     50        (WebCore::CSPDirectiveList::create):
     51            The static constructor wrapper now passes the type into the real
     52            constructor, which also now handles setting its internal variables.
     53        (WebCore::CSPDirectiveList::parse):
     54            'parse()' is given the header, so it makes sense to store it here as
     55            well, rather than in the create wrapper.
     56        (WebCore::CSPDirectiveList::addDirective):
     57            1.1 directives remain locked behind CSP_NEXT, but now also require
     58            that 'm_experimental' is set, signaling usage of the prefixed header
     59            and an implicit opt-in to 1.1.
     60        * page/ContentSecurityPolicy.h:
     61            Added two new types to the HeaderTypes enum: PrefixedReportOnly, and
     62            PrefixedEnforcePolicy. These map to 'X-WebKitCSP-Report-Only' and
     63            'X-WebKit-CSP', respectively.
     64
    1652012-10-31  Roger Fong  <roger_fong@apple.com>
    266

  • trunk/Source/WebCore/dom/Document.cpp

    r133028 r133095  
    29672967            }
    29682968        }
    2969     } else if (equalIgnoringCase(equiv, "x-webkit-csp"))
    2970         contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicy::EnforcePolicy);
     2969    } else if (equalIgnoringCase(equiv, "content-security-policy"))
     2970        contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicy::EnforceStableDirectives);
     2971    else if (equalIgnoringCase(equiv, "content-security-policy-report-only"))
     2972        contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicy::ReportStableDirectives);
     2973    else if (equalIgnoringCase(equiv, "x-webkit-csp"))
     2974        contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicy::EnforceAllDirectives);
    29712975    else if (equalIgnoringCase(equiv, "x-webkit-csp-report-only"))
    2972         contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicy::ReportOnly);
     2976        contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicy::ReportAllDirectives);
    29732977}
    29742978

  • trunk/Source/WebCore/loader/FrameLoader.cpp

    r133053 r133095  
    661661            m_frame->document()->parseDNSPrefetchControlHeader(dnsPrefetchControl);
    662662
    663         String contentSecurityPolicy = m_documentLoader->response().httpHeaderField("X-WebKit-CSP");
    664         if (!contentSecurityPolicy.isEmpty())
    665             m_frame->document()->contentSecurityPolicy()->didReceiveHeader(contentSecurityPolicy, ContentSecurityPolicy::EnforcePolicy);
    666 
    667         String reportOnlyContentSecurityPolicy = m_documentLoader->response().httpHeaderField("X-WebKit-CSP-Report-Only");
    668         if (!reportOnlyContentSecurityPolicy.isEmpty())
    669             m_frame->document()->contentSecurityPolicy()->didReceiveHeader(reportOnlyContentSecurityPolicy, ContentSecurityPolicy::ReportOnly);
     663        String policyValue = m_documentLoader->response().httpHeaderField("Content-Security-Policy");
     664        if (!policyValue.isEmpty())
     665            m_frame->document()->contentSecurityPolicy()->didReceiveHeader(policyValue, ContentSecurityPolicy::EnforceStableDirectives);
     666
     667        policyValue = m_documentLoader->response().httpHeaderField("Content-Security-Policy-Report-Only");
     668        if (!policyValue.isEmpty())
     669            m_frame->document()->contentSecurityPolicy()->didReceiveHeader(policyValue, ContentSecurityPolicy::ReportStableDirectives);
     670
     671        policyValue = m_documentLoader->response().httpHeaderField("X-WebKit-CSP");
     672        if (!policyValue.isEmpty())
     673            m_frame->document()->contentSecurityPolicy()->didReceiveHeader(policyValue, ContentSecurityPolicy::EnforceAllDirectives);
     674
     675        policyValue = m_documentLoader->response().httpHeaderField("X-WebKit-CSP-Report-Only");
     676        if (!policyValue.isEmpty())
     677            m_frame->document()->contentSecurityPolicy()->didReceiveHeader(policyValue, ContentSecurityPolicy::ReportAllDirectives);
    670678
    671679        String headerContentLanguage = m_documentLoader->response().httpHeaderField("Content-Language");

  • trunk/Source/WebCore/page/ContentSecurityPolicy.cpp

    r131413 r133095  
    773773
    774774    const String& header() const { return m_header; }
    775     ContentSecurityPolicy::HeaderType headerType() const { return m_reportOnly ? ContentSecurityPolicy::ReportOnly : ContentSecurityPolicy::EnforcePolicy; }
     775    ContentSecurityPolicy::HeaderType headerType() const { return m_headerType; }
    776776
    777777    bool allowJavaScriptURLs(const String& contextURL, const WTF::OrdinalNumber& contextLine, ContentSecurityPolicy::ReportingStatus) const;
    … …  
    797797
    798798private:
    799     explicit CSPDirectiveList(ContentSecurityPolicy*);
     799    CSPDirectiveList(ContentSecurityPolicy*, ContentSecurityPolicy::HeaderType);
    800800
    801801    void parse(const String&);
    … …  
    834834
    835835    String m_header;
    836 
     836    ContentSecurityPolicy::HeaderType m_headerType;
     837
     838    bool m_experimental;
    837839    bool m_reportOnly;
    838840    bool m_haveSandboxPolicy;
    … …  
    856858};
    857859
    858 CSPDirectiveList::CSPDirectiveList(ContentSecurityPolicy* policy)
     860CSPDirectiveList::CSPDirectiveList(ContentSecurityPolicy* policy, ContentSecurityPolicy::HeaderType type)
    859861    : m_policy(policy)
     862    , m_headerType(type)
     863    , m_experimental(false)
    860864    , m_reportOnly(false)
    861865    , m_haveSandboxPolicy(false)
    862866{
     867    m_reportOnly = (type == ContentSecurityPolicy::ReportStableDirectives || type == ContentSecurityPolicy::ReportAllDirectives);
     868    m_experimental = (type == ContentSecurityPolicy::ReportAllDirectives || type == ContentSecurityPolicy::EnforceAllDirectives);
    863869}
    864870
    865871PassOwnPtr<CSPDirectiveList> CSPDirectiveList::create(ContentSecurityPolicy* policy, const String& header, ContentSecurityPolicy::HeaderType type)
    866872{
    867     OwnPtr<CSPDirectiveList> directives = adoptPtr(new CSPDirectiveList(policy));
     873    OwnPtr<CSPDirectiveList> directives = adoptPtr(new CSPDirectiveList(policy, type));
    868874    directives->parse(header);
    869     directives->m_header = header;
    870 
    871     switch (type) {
    872     case ContentSecurityPolicy::ReportOnly:
    873         directives->m_reportOnly = true;
    874         return directives.release();
    875     case ContentSecurityPolicy::EnforcePolicy:
    876         ASSERT(!directives->m_reportOnly);
    877         break;
    878     }
    879875
    880876    if (!directives->checkEval(directives->operativeDirective(directives->m_scriptSrc.get()))) {
    … …  
    11521148void CSPDirectiveList::parse(const String& policy)
    11531149{
     1150    m_header = policy;
    11541151    if (policy.isEmpty())
    11551152        return;
    … …  
    12981295        parseReportURI(name, value);
    12991296#if ENABLE(CSP_NEXT)
    1300     else if (equalIgnoringCase(name, formAction))
    1301         setCSPDirective<SourceListDirective>(name, value, m_formAction);
    1302     else if (equalIgnoringCase(name, pluginTypes))
    1303         setCSPDirective<MediaListDirective>(name, value, m_pluginTypes);
    1304     else if (equalIgnoringCase(name, scriptNonce))
    1305         setCSPDirective<NonceDirective>(name, value, m_scriptNonce);
     1297    else if (m_experimental) {
     1298        if (equalIgnoringCase(name, formAction))
     1299            setCSPDirective<SourceListDirective>(name, value, m_formAction);
     1300        else if (equalIgnoringCase(name, pluginTypes))
     1301            setCSPDirective<MediaListDirective>(name, value, m_pluginTypes);
     1302        else if (equalIgnoringCase(name, scriptNonce))
     1303            setCSPDirective<NonceDirective>(name, value, m_scriptNonce);
     1304    }
    13061305#endif
    13071306    else
    … …  
    13691368ContentSecurityPolicy::HeaderType ContentSecurityPolicy::deprecatedHeaderType() const
    13701369{
    1371     return m_policies.isEmpty() ? EnforcePolicy : m_policies[0]->headerType();
     1370    return m_policies.isEmpty() ? EnforceStableDirectives : m_policies[0]->headerType();
    13721371}
    13731372

  • trunk/Source/WebCore/page/ContentSecurityPolicy.h

    r131413 r133095  
    6161
    6262    enum HeaderType {
    63         ReportOnly,
    64         EnforcePolicy
     63        ReportStableDirectives,
     64        EnforceStableDirectives,
     65        ReportAllDirectives,
     66        EnforceAllDirectives
    6567    };
    6668

  • trunk/Source/WebKit/chromium/public/WebContentSecurityPolicy.h

    r105380 r133095  
    3535
    3636enum WebContentSecurityPolicyType {
    37     WebContentSecurityPolicyTypeReportOnly,
    38     WebContentSecurityPolicyTypeEnforcePolicy
     37    WebContentSecurityPolicyTypeReportStableDirectives,
     38    WebContentSecurityPolicyTypeEnforceStableDirectives,
     39    WebContentSecurityPolicyTypeReportAllDirectives,
     40    WebContentSecurityPolicyTypeEnforceAllDirectives,
    3941};
    4042

  • trunk/Source/WebKit/chromium/src/AssertMatchingEnums.cpp

    r132915 r133095  
    621621COMPILE_ASSERT_MATCHING_ENUM(WebReferrerPolicyOrigin, ReferrerPolicyOrigin);
    622622
    623 COMPILE_ASSERT_MATCHING_ENUM(WebContentSecurityPolicyTypeReportOnly, ContentSecurityPolicy::ReportOnly);
    624 COMPILE_ASSERT_MATCHING_ENUM(WebContentSecurityPolicyTypeEnforcePolicy, ContentSecurityPolicy::EnforcePolicy);
     623COMPILE_ASSERT_MATCHING_ENUM(WebContentSecurityPolicyTypeReportStableDirectives, ContentSecurityPolicy::ReportStableDirectives);
     624COMPILE_ASSERT_MATCHING_ENUM(WebContentSecurityPolicyTypeEnforceStableDirectives, ContentSecurityPolicy::EnforceStableDirectives);
     625COMPILE_ASSERT_MATCHING_ENUM(WebContentSecurityPolicyTypeReportAllDirectives, ContentSecurityPolicy::ReportAllDirectives);
     626COMPILE_ASSERT_MATCHING_ENUM(WebContentSecurityPolicyTypeEnforceAllDirectives, ContentSecurityPolicy::EnforceAllDirectives);
    625627
    626628COMPILE_ASSERT_MATCHING_ENUM(WebURLResponse::Unknown, ResourceResponse::Unknown);
Note: See TracChangeset for help on using the changeset viewer.