Changeset 96667 in webkit

Timestamp:

Oct 4, 2011 5:52:50 PM (13 years ago)

Author:

weinig@apple.com

Message:

Wean ContentSecurityPolicy from the Document
​https://bugs.webkit.org/show_bug.cgi?id=69387

Reviewed by Adam Barth.

• bindings/js/WorkerScriptController.cpp:

(WebCore::WorkerScriptController::disableEval):

• bindings/js/WorkerScriptController.h:
• dom/Document.cpp:

(WebCore::Document::disableEval):

• dom/Document.h:
• workers/WorkerContext.cpp:

(WebCore::WorkerContext::disableEval):

• workers/WorkerContext.h:
• dom/ScriptExecutionContext.h:

Add pure virtual disableEval to ScriptExecutionContext, so that ContentSecurityPolicy
can call it for both Documents and WorkerContexts.

• page/ContentSecurityPolicy.cpp:

(WebCore::ContentSecurityPolicy::didReceiveHeader):
Call the new ScriptExecutionContext::disableEval() function.

(WebCore::ContentSecurityPolicy::reportViolation):
Use ScriptExecutionContext::addMessage() instead of going directly to the DOMWindow.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• bindings/js/WorkerScriptController.cpp (modified) (1 diff)
• bindings/js/WorkerScriptController.h (modified) (1 diff)
• dom/Document.cpp (modified) (1 diff)
• dom/Document.h (modified) (1 diff)
• dom/ScriptExecutionContext.h (modified) (1 diff)
• page/ContentSecurityPolicy.cpp (modified) (4 diffs)
• workers/WorkerContext.cpp (modified) (1 diff)
• workers/WorkerContext.h (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-10-04  Sam Weinig  <sam@webkit.org>
+
+        Wean ContentSecurityPolicy from the Document
+        https://bugs.webkit.org/show_bug.cgi?id=69387
+
+        Reviewed by Adam Barth.
+
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::disableEval):
+        * bindings/js/WorkerScriptController.h:
+        * dom/Document.cpp:
+        (WebCore::Document::disableEval):
+        * dom/Document.h:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::disableEval):
+        * workers/WorkerContext.h:
+        * dom/ScriptExecutionContext.h:
+        Add pure virtual disableEval to ScriptExecutionContext, so that ContentSecurityPolicy
+        can call it for both Documents and WorkerContexts.
+
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::ContentSecurityPolicy::didReceiveHeader):
+        Call the new ScriptExecutionContext::disableEval() function.
+
+        (WebCore::ContentSecurityPolicy::reportViolation):
+        Use ScriptExecutionContext::addMessage() instead of going directly to the DOMWindow.
+
 2011-10-04  Anders Carlsson  <andersca@apple.com>
 

trunk/Source/WebCore/bindings/js/WorkerScriptController.cpp

@@ -182 +182 @@
 }
 
+void WorkerScriptController::disableEval()
+{
+    initScriptIfNeeded();
+    JSLock lock(SilenceAssertionsOnly);
+
+    m_workerContextWrapper->setEvalEnabled(false);
+}
+
 } // namespace WebCore
 

trunk/Source/WebCore/bindings/js/WorkerScriptController.h

@@ -74 +74 @@
         bool isExecutionForbidden() const;
 
+        void disableEval();
+
         JSC::JSGlobalData* globalData() { return m_globalData.get(); }
 

trunk/Source/WebCore/dom/Document.cpp

@@ -2439 +2439 @@
 }
 
+void Document::disableEval()
+{
+    if (!frame())
+        return;
+
+    frame()->script()->disableEval();
+}
+
 CSSStyleSheet* Document::pageUserSheet()
 {

trunk/Source/WebCore/dom/Document.h

@@ -613 +613 @@
     virtual String userAgent(const KURL&) const;
 
+    virtual void disableEval() OVERRIDE;
+
     CSSStyleSheet* pageUserSheet();
     void clearPageUserSheet();

trunk/Source/WebCore/dom/ScriptExecutionContext.h

@@ -97 +97 @@
         virtual String userAgent(const KURL&) const = 0;
 
+        virtual void disableEval() = 0;
+
         SecurityOrigin* securityOrigin() const { return m_securityOrigin.get(); }
         ContentSecurityPolicy* contentSecurityPolicy() { return m_contentSecurityPolicy.get(); }

trunk/Source/WebCore/page/ContentSecurityPolicy.cpp

@@ -28 +28 @@
 
 #include "Console.h"
-#include "DOMWindow.h"
 #include "Document.h"
 #include "FormData.h"
@@ -34 +33 @@
 #include "Frame.h"
 #include "PingLoader.h"
+#include "ScriptCallStack.h"
 #include "SecurityOrigin.h"
 #include "TextEncoding.h"
@@ -492 +492 @@
     }
 
-    if (!checkEval(operativeDirective(m_scriptSrc.get()))) {
-        // FIXME: Support disabling eval for Workers.
-        if (m_scriptExecutionContext->isDocument()) {
-            if (Frame* frame = static_cast<Document*>(m_scriptExecutionContext)->frame())
-                frame->script()->disableEval();
-        }
-    }
+    if (!checkEval(operativeDirective(m_scriptSrc.get())))
+        m_scriptExecutionContext->disableEval();
 }
 
 void ContentSecurityPolicy::reportViolation(const String& directiveText, const String& consoleMessage) const
 {
-    // FIXME: Support reporting violations for Workers.
+    String message = m_reportOnly ? "[Report Only] " + consoleMessage : consoleMessage;
+    m_scriptExecutionContext->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message, 1, String(), 0);
+
+    if (m_reportURLs.isEmpty())
+        return;
+
+    // FIXME: Support sending reports from worker.
     if (!m_scriptExecutionContext->isDocument())
         return;
@@ -510 +511 @@
     Frame* frame = document->frame();
     if (!frame)
-        return;
-
-    String message = m_reportOnly ? "[Report Only] " + consoleMessage : consoleMessage;
-    frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message, 1, String());
-
-    if (m_reportURLs.isEmpty())
         return;
 

trunk/Source/WebCore/workers/WorkerContext.cpp

@@ -166 +166 @@
 }
 
+void WorkerContext::disableEval()
+{
+    m_script->disableEval();
+}
+
 WorkerLocation* WorkerContext::location() const
 {

trunk/Source/WebCore/workers/WorkerContext.h

@@ -78 +78 @@
         virtual String userAgent(const KURL&) const;
 
+        virtual void disableEval() OVERRIDE;
+
         WorkerScriptController* script() { return m_script.get(); }
         void clearScript() { m_script.clear(); }