Changeset 136305 in webkit

Timestamp:

Nov 30, 2012, 10:53:25 PM (13 years ago)

Author:

mkwst@chromium.org

Message:

CSP 1.1: Make the CSP_NEXT flag runtime enabled.
​https://bugs.webkit.org/show_bug.cgi?id=103652

Reviewed by Adam Barth.

Source/WebCore:

Content Security Policy 1.1 continues to live behind the CSP_NEXT flag,
this patch adds another layer on top of that in order to enable runtime
decisions about whether it should be active.

• bindings/generic/RuntimeEnabledFeatures.cpp:

(WebCore):

• bindings/generic/RuntimeEnabledFeatures.h:

(RuntimeEnabledFeatures):
(WebCore::RuntimeEnabledFeatures::experimentalContentSecurityPolicyFeaturesEnabled):
(WebCore::RuntimeEnabledFeatures::setExperimentalContentSecurityPolicyFeaturesEnabled):

Adds methods in order to correctly handle enabling and disabling
CSP 1.1 features.

• dom/Document.idl:

Gate the 'document.securityPolicy' object on the runtime flag.

• page/ContentSecurityPolicy.cpp:

(WebCore::CSPDirectiveList::addDirective):

Check that experimental features are runtime enabled before
processing 1.1 directives.

(WebCore::ContentSecurityPolicy::experimentalFeaturesEnabled):
(WebCore):

• page/ContentSecurityPolicy.h:

Adds a new method which checks against the runtime flag to determine
whether CSP 1.1 features are enabled.

Source/WebKit/chromium:

The CSP_NEXT flag continues to be enabled on the Chromium port, but this
patch now locks the features away behind the securityPolicy runtime
flag.

• public/WebRuntimeFeatures.h:

(WebRuntimeFeatures):

• src/WebRuntimeFeatures.cpp:

(WebKit::WebRuntimeFeatures::enableExperimentalContentSecurityPolicyFeatures):
(WebKit):
(WebKit::WebRuntimeFeatures::isExperimentalContentSecurityPolicyFeaturesEnabled):

Adds the feature to WebRuntimeFeatures so it can be toggled from
inside Chromium.

Tools:

Ensures that the new SecurityPolicy runtime flag is enabled for Chromium's tests.

• DumpRenderTree/chromium/TestShell.cpp:

(TestShell::TestShell):

Location:

trunk

Files:

• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp (modified) (1 diff)
• Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h (modified) (2 diffs)
• Source/WebCore/dom/Document.idl (modified) (1 diff)
• Source/WebCore/page/ContentSecurityPolicy.cpp (modified) (3 diffs)
• Source/WebCore/page/ContentSecurityPolicy.h (modified) (1 diff)
• Source/WebKit/chromium/ChangeLog (modified) (1 diff)
• Source/WebKit/chromium/public/WebRuntimeFeatures.h (modified) (1 diff)
• Source/WebKit/chromium/src/WebRuntimeFeatures.cpp (modified) (1 diff)
• Tools/ChangeLog (modified) (1 diff)
• Tools/DumpRenderTree/chromium/TestShell.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-11-30  Mike West  <mkwst@chromium.org>
+
+        CSP 1.1: Make the CSP_NEXT flag runtime enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=103652
+
+        Reviewed by Adam Barth.
+
+        Content Security Policy 1.1 continues to live behind the CSP_NEXT flag,
+        this patch adds another layer on top of that in order to enable runtime
+        decisions about whether it should be active.
+
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        (WebCore):
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (RuntimeEnabledFeatures):
+        (WebCore::RuntimeEnabledFeatures::experimentalContentSecurityPolicyFeaturesEnabled):
+        (WebCore::RuntimeEnabledFeatures::setExperimentalContentSecurityPolicyFeaturesEnabled):
+            Adds methods in order to correctly handle enabling and disabling
+            CSP 1.1 features.
+        * dom/Document.idl:
+            Gate the 'document.securityPolicy' object on the runtime flag.
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::CSPDirectiveList::addDirective):
+            Check that experimental features are runtime enabled before
+            processing 1.1 directives.
+        (WebCore::ContentSecurityPolicy::experimentalFeaturesEnabled):
+        (WebCore):
+        * page/ContentSecurityPolicy.h:
+            Adds a new method which checks against the runtime flag to determine
+            whether CSP 1.1 features are enabled.
+
 2012-11-30  Simon Fraser  <simon.fraser@apple.com>
 

trunk/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp

@@ -230 +230 @@
 #endif
 
+#if ENABLE(CSP_NEXT)
+bool RuntimeEnabledFeatures::areExperimentalContentSecurityPolicyFeaturesEnabled = false;
+#endif
+
 } // namespace WebCore

trunk/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h

@@ -256 +256 @@
 #endif
 
+#if ENABLE(CSP_NEXT)
+    static bool experimentalContentSecurityPolicyFeaturesEnabled() { return areExperimentalContentSecurityPolicyFeaturesEnabled; }
+    static void setExperimentalContentSecurityPolicyFeaturesEnabled(bool isEnabled) { areExperimentalContentSecurityPolicyFeaturesEnabled = isEnabled; }
+#endif
+
     static bool langAttributeAwareFormControlUIEnabled() { return isLangAttributeAwareFormControlUIEnabled; }
     // The lang attribute support is incomplete and should only be turned on for tests.
@@ -366 +371 @@
     static bool isRequestAutocompleteEnabled;
 #endif
+
+#if ENABLE(CSP_NEXT)
+    static bool areExperimentalContentSecurityPolicyFeaturesEnabled;
+#endif
 };
 

trunk/Source/WebCore/dom/Document.idl

@@ -367 +367 @@
 
     // Security Policy API: http://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html#script-interfaces
-    [Conditional=CSP_NEXT] readonly attribute DOMSecurityPolicy securityPolicy;
+    [Conditional=CSP_NEXT, V8EnabledAtRuntime=experimentalContentSecurityPolicyFeatures] readonly attribute DOMSecurityPolicy securityPolicy;
 
 };

trunk/Source/WebCore/page/ContentSecurityPolicy.cpp

@@ -38 +38 @@
 #include "KURL.h"
 #include "PingLoader.h"
+#include "RuntimeEnabledFeatures.h"
 #include "SchemeRegistry.h"
 #include "ScriptCallStack.h"
@@ -1314 +1315 @@
         parseReportURI(name, value);
 #if ENABLE(CSP_NEXT)
-    else if (m_experimental) {
+    else if (m_experimental && m_policy->experimentalFeaturesEnabled()) {
         if (equalIgnoringCase(name, formAction))
             setCSPDirective<SourceListDirective>(name, value, m_formAction);
@@ -1711 +1712 @@
 }
 
-}
+bool ContentSecurityPolicy::experimentalFeaturesEnabled() const
+{
+#if ENABLE(CSP_NEXT)
+    return RuntimeEnabledFeatures::experimentalContentSecurityPolicyFeaturesEnabled();
+#else
+    return false;
+#endif
+}
+
+}

trunk/Source/WebCore/page/ContentSecurityPolicy.h

@@ -121 +121 @@
     String evalDisabledErrorMessage() const;
 
+    bool experimentalFeaturesEnabled() const;
+
 private:
     explicit ContentSecurityPolicy(ScriptExecutionContext*);

trunk/Source/WebKit/chromium/ChangeLog

@@ +1 @@
+2012-11-30  Mike West  <mkwst@chromium.org>
+
+        CSP 1.1: Make the CSP_NEXT flag runtime enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=103652
+
+        Reviewed by Adam Barth.
+
+        The CSP_NEXT flag continues to be enabled on the Chromium port, but this
+        patch now locks the features away behind the securityPolicy runtime
+        flag.
+
+        * public/WebRuntimeFeatures.h:
+        (WebRuntimeFeatures):
+        * src/WebRuntimeFeatures.cpp:
+        (WebKit::WebRuntimeFeatures::enableExperimentalContentSecurityPolicyFeatures):
+        (WebKit):
+        (WebKit::WebRuntimeFeatures::isExperimentalContentSecurityPolicyFeaturesEnabled):
+            Adds the feature to WebRuntimeFeatures so it can be toggled from
+            inside Chromium.
+
 2012-11-30  Stephen White  <senorblanco@chromium.org>
 

trunk/Source/WebKit/chromium/public/WebRuntimeFeatures.h

@@ -161 +161 @@
     WEBKIT_EXPORT static bool isCSSRegionsEnabled();
 
+    WEBKIT_EXPORT static void enableExperimentalContentSecurityPolicyFeatures(bool);
+    WEBKIT_EXPORT static bool isExperimentalContentSecurityPolicyFeaturesEnabled();
 private:
     WebRuntimeFeatures();

trunk/Source/WebKit/chromium/src/WebRuntimeFeatures.cpp

@@ -612 +612 @@
 }
 
+void WebRuntimeFeatures::enableExperimentalContentSecurityPolicyFeatures(bool enable)
+{
+#if ENABLE(CSP_NEXT)
+    RuntimeEnabledFeatures::setExperimentalContentSecurityPolicyFeaturesEnabled(enable);
+#else
+    UNUSED_PARAM(enable);
+#endif
+}
+
+bool WebRuntimeFeatures::isExperimentalContentSecurityPolicyFeaturesEnabled()
+{
+#if ENABLE(CSP_NEXT)
+    return RuntimeEnabledFeatures::experimentalContentSecurityPolicyFeaturesEnabled();
+#else
+    return false;
+#endif
+}
+
 void WebRuntimeFeatures::enableCSSExclusions(bool enable)
 {

trunk/Tools/ChangeLog

@@ +1 @@
+2012-11-30  Mike West  <mkwst@chromium.org>
+
+        CSP 1.1: Make the CSP_NEXT flag runtime enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=103652
+
+        Reviewed by Adam Barth.
+
+        Ensures that the new SecurityPolicy runtime flag is enabled for Chromium's tests.
+
+        * DumpRenderTree/chromium/TestShell.cpp:
+        (TestShell::TestShell):
+
 2012-11-30  Roger Fong  <roger_fong@apple.com>
 

trunk/Tools/DumpRenderTree/chromium/TestShell.cpp

@@ -149 +149 @@
     WebRuntimeFeatures::enableScriptedSpeech(true);
     WebRuntimeFeatures::enableRequestAutocomplete(true);
+    WebRuntimeFeatures::enableExperimentalContentSecurityPolicyFeatures(true);
 
     // 30 second is the same as the value in Mac DRT.