Changeset 86586 in webkit


Ignore:
Timestamp:
May 16, 2011 10:32:04 AM (13 years ago)
Author:
abarth@webkit.org
Message:

2011-05-16 Adam Barth <​abarth@webkit.org>

Reviewed by Darin Adler.

Remove disable-javascript-urls CSP directive
​https://bugs.webkit.org/show_bug.cgi?id=60874

No need to test a feature that doesn't exist.

  • http/tests/security/contentSecurityPolicy/javascript-urls-blocked-expected.txt: Removed.
  • http/tests/security/contentSecurityPolicy/javascript-urls-blocked.html: Removed.

2011-05-16 Adam Barth <​abarth@webkit.org>

Reviewed by Darin Adler.

Remove disable-javascript-urls CSP directive
​https://bugs.webkit.org/show_bug.cgi?id=60874

After talking this out with various folks in the CSP working group, we
decided that this syntax isn't the right way to approach this issue.
If we want to address the use case of enabling JavaScript URLs
separately from inline script, we'll probably just make

script-src javascript:

work that way.

  • page/ContentSecurityPolicy.cpp: (WebCore::ContentSecurityPolicy::ContentSecurityPolicy): (WebCore::ContentSecurityPolicy::allowJavaScriptURLs): (WebCore::ContentSecurityPolicy::addDirective):
  • page/ContentSecurityPolicy.h:
Location:
trunk
Files:
2 deleted
4 edited

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r86583 r86586  
     12011-05-16  Adam Barth  <abarth@webkit.org>
     2
     3        Reviewed by Darin Adler.
     4
     5        Remove disable-javascript-urls CSP directive
     6        https://bugs.webkit.org/show_bug.cgi?id=60874
     7
     8        No need to test a feature that doesn't exist.
     9
     10        * http/tests/security/contentSecurityPolicy/javascript-urls-blocked-expected.txt: Removed.
     11        * http/tests/security/contentSecurityPolicy/javascript-urls-blocked.html: Removed.
     12
    1132011-05-16  Leandro Gracia Gil  <leandrogracia@chromium.org>
    214

  • trunk/Source/WebCore/ChangeLog

    r86584 r86586  
     12011-05-16  Adam Barth  <abarth@webkit.org>
     2
     3        Reviewed by Darin Adler.
     4
     5        Remove disable-javascript-urls CSP directive
     6        https://bugs.webkit.org/show_bug.cgi?id=60874
     7
     8        After talking this out with various folks in the CSP working group, we
     9        decided that this syntax isn't the right way to approach this issue.
     10        If we want to address the use case of enabling JavaScript URLs
     11        separately from inline script, we'll probably just make
     12
     13          script-src javascript:
     14
     15        work that way.
     16
     17        * page/ContentSecurityPolicy.cpp:
     18        (WebCore::ContentSecurityPolicy::ContentSecurityPolicy):
     19        (WebCore::ContentSecurityPolicy::allowJavaScriptURLs):
     20        (WebCore::ContentSecurityPolicy::addDirective):
     21        * page/ContentSecurityPolicy.h:
     22
    1232011-05-16  Jon Lee  <jonlee@apple.com>
    224

  • trunk/Source/WebCore/page/ContentSecurityPolicy.cpp

    r86542 r86586  
    457457    , m_document(document)
    458458    , m_reportOnly(false)
    459     , m_disableJavaScriptURLs(false)
    460459{
    461460}
    … …  
    558557{
    559558    DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute JavaScript URL because of Content-Security-Policy.\n"));
    560     if (m_disableJavaScriptURLs) {
    561         reportViolation(String(), consoleMessage);
    562         return denyIfEnforcingPolicy();
    563     }
    564559    return checkInlineAndReportViolation(operativeDirective(m_scriptSrc.get()), consoleMessage);
    565560}
    … …  
    736731    DEFINE_STATIC_LOCAL(String, mediaSrc, ("media-src"));
    737732    DEFINE_STATIC_LOCAL(String, reportURI, ("report-uri"));
    738     DEFINE_STATIC_LOCAL(String, disableJavaScriptURLs, ("disable-javascript-urls"));
    739733
    740734    ASSERT(!name.isEmpty());
    … …  
    758752    else if (m_reportURLs.isEmpty() && equalIgnoringCase(name, reportURI))
    759753        parseReportURI(value);
    760     else if (equalIgnoringCase(name, disableJavaScriptURLs))
    761         m_disableJavaScriptURLs = true;
    762 }
    763 
    764 }
     754}
     755
     756}

  • trunk/Source/WebCore/page/ContentSecurityPolicy.h

    r85993 r86586  
    9797    OwnPtr<CSPDirective> m_fontSrc;
    9898    OwnPtr<CSPDirective> m_mediaSrc;
    99 
    100     // This directive is an experiment and not part of the W3C spec.
    101     // FIXME: Remove this feature when we rename from X-WebKit-CSP to
    102     // Content-Security-Policy if we don't convince the working group to adopt
    103     // the feature.
    104     bool m_disableJavaScriptURLs;
    105 
    10699    Vector<KURL> m_reportURLs;
    107100};
Note: See TracChangeset for help on using the changeset viewer.