Changeset 78497 in webkit

Timestamp:

Feb 14, 2011 12:48:12 PM (13 years ago)

Author:

abarth@webkit.org

Message:

2011-02-14 Adam Barth <​abarth@webkit.org>

Reviewed by Eric Seidel.

Add basic parser for Content Security Policy
​https://bugs.webkit.org/show_bug.cgi?id=54379

Add a constructor for copying a Vector into a String. I suspect there
are a number of call sites that are doing this manually that would
benefit from being moved to this API.

• wtf/text/WTFString.h: (WTF::String::String):

2011-02-14 Adam Barth <​abarth@webkit.org>

Reviewed by Eric Seidel.

Add basic parser for Content Security Policy
​https://bugs.webkit.org/show_bug.cgi?id=54379

The parser in this patch is very basic. It just segments the CSP
header into directives. The exactly syntax will likely change a bit as
we discuss the details in public-web-security, but this parser will
allow us to make progress.

Sadly, this patch does not contain any tests. That's because CSP
policies do not have any observable effects yet. Hopefully we'll get
enough sketched out in the next couple patches to begin writing tests.

• page/ContentSecurityPolicy.cpp: (WebCore::CSPDirective::CSPDirective): (WebCore::CSPDirective::name): (WebCore::CSPDirective::value): (WebCore::ContentSecurityPolicy::~ContentSecurityPolicy): (WebCore::ContentSecurityPolicy::didReceiveHeader): (WebCore::ContentSecurityPolicy::parse):
• page/ContentSecurityPolicy.h:

Location:

trunk/Source

Files:

• JavaScriptCore/ChangeLog (modified) (1 diff)
• JavaScriptCore/wtf/text/WTFString.h (modified) (2 diffs)
• WebCore/ChangeLog (modified) (1 diff)
• WebCore/page/ContentSecurityPolicy.cpp (modified) (3 diffs)
• WebCore/page/ContentSecurityPolicy.h (modified) (3 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-02-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add basic parser for Content Security Policy
+        https://bugs.webkit.org/show_bug.cgi?id=54379
+
+        Add a constructor for copying a Vector into a String.  I suspect there
+        are a number of call sites that are doing this manually that would
+        benefit from being moved to this API.
+
+        * wtf/text/WTFString.h:
+        (WTF::String::String):
+
 2011-02-14  Pavel Podivilov  <podivilov@chromium.org>
 

trunk/Source/JavaScriptCore/wtf/text/WTFString.h

@@ -93 +93 @@
     String(const UChar* characters, unsigned length);
 
+    // Construct a string by copying the contents of a vector.  To avoid
+    // copying, consider using String::adopt instead.
+    template<size_t inlineCapacity>
+    explicit String(const Vector<UChar, inlineCapacity>&);
+
     // Construct a string with UTF-16 data, from a null-terminated source.
     String(const UChar*);
@@ -378 +383 @@
 
 // Definitions of string operations
+
+template<size_t inlineCapacity>
+String::String(const Vector<UChar, inlineCapacity>& vector)
+    : m_impl(vector.size() ? StringImpl::create(vector.data(), vector.size()) : 0)
+{
+}
 
 #ifdef __OBJC__

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-02-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add basic parser for Content Security Policy
+        https://bugs.webkit.org/show_bug.cgi?id=54379
+
+        The parser in this patch is very basic.  It just segments the CSP
+        header into directives.  The exactly syntax will likely change a bit as
+        we discuss the details in public-web-security, but this parser will
+        allow us to make progress.
+
+        Sadly, this patch does not contain any tests.  That's because CSP
+        policies do not have any observable effects yet.  Hopefully we'll get
+        enough sketched out in the next couple patches to begin writing tests.
+
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::CSPDirective::CSPDirective):
+        (WebCore::CSPDirective::name):
+        (WebCore::CSPDirective::value):
+        (WebCore::ContentSecurityPolicy::~ContentSecurityPolicy):
+        (WebCore::ContentSecurityPolicy::didReceiveHeader):
+        (WebCore::ContentSecurityPolicy::parse):
+        * page/ContentSecurityPolicy.h:
+
 2011-02-14  Andrew Wason  <rectalogic@rectalogic.com>
 

trunk/Source/WebCore/page/ContentSecurityPolicy.cpp

@@ -30 +30 @@
 namespace WebCore {
 
+class CSPDirective {
+public:
+    CSPDirective(const String& name, const String& value)
+        : m_name(name)
+        , m_value(value)
+    {
+    }
+
+    const String& name() const { return m_name; }
+    const String& value() const { return m_value; }
+
+private:
+    String m_name;
+    String m_value;
+};
+
 ContentSecurityPolicy::ContentSecurityPolicy()
     : m_isEnabled(false)
@@ -35 +51 @@
 }
 
+ContentSecurityPolicy::~ContentSecurityPolicy()
+{
+}
+
 void ContentSecurityPolicy::didReceiveHeader(const String& header)
 {
+    if (!m_directives.isEmpty())
+        return; // The first policy wins.
+
     m_isEnabled = true;
-    m_header = header;
+    parse(header);
 }
 
@@ -46 +69 @@
 }
 
+void ContentSecurityPolicy::parse(const String& policy)
+{
+    ASSERT(m_directives.isEmpty());
+
+    if (policy.isEmpty())
+        return;
+
+    enum {
+        BeforeDirectiveName,
+        DirectiveName,
+        AfterDirectiveName,
+        DirectiveValue,
+    } state = BeforeDirectiveName;
+
+    const UChar* pos = policy.characters();
+    const UChar* end = pos + policy.length();
+
+    Vector<UChar, 32> name;
+    Vector<UChar, 64> value;
+
+    while (pos < end) {
+        UChar currentCharacter = *pos++;
+        switch (state) {
+        case BeforeDirectiveName:
+            if (isASCIISpace(currentCharacter))
+                continue;
+            state = DirectiveName;
+            // Fall through.
+        case DirectiveName:
+            if (!isASCIISpace(currentCharacter)) {
+                name.append(currentCharacter);
+                continue;
+            }
+            state = AfterDirectiveName;
+            // Fall through.
+        case AfterDirectiveName:
+            if (isASCIISpace(currentCharacter))
+                continue;
+            state = DirectiveValue;
+            // Fall through.
+        case DirectiveValue:
+            if (currentCharacter != ';') {
+                value.append(currentCharacter);
+                continue;
+            }
+            // We use a copy here instead of String::adopt because we expect
+            // the name and the value to be relatively short, so the copy will
+            // be cheaper than the extra malloc.
+            // FIXME: Perform directive-specific parsing of the value.
+            m_directives.append(CSPDirective(String(name), String(value)));
+            name.clear();
+            value.clear();
+            state = BeforeDirectiveName;
+            continue;
+        }
+    }
 }
+
+}

trunk/Source/WebCore/page/ContentSecurityPolicy.h

@@ -27 +27 @@
 #define ContentSecurityPolicy_h
 
+#include <wtf/Vector.h>
 #include <wtf/text/WTFString.h>
 
 namespace WebCore {
+
+class CSPDirective;
 
 class ContentSecurityPolicy {
@@ -35 +38 @@
 public:
     ContentSecurityPolicy();
+    ~ContentSecurityPolicy();
 
     void didReceiveHeader(const String&);
@@ -40 +44 @@
 
 private:
+    typedef Vector<CSPDirective> DirectiveList;
+
+    void parse(const String&);
+
     bool m_isEnabled;
-    String m_header;
+    DirectiveList m_directives;
 };