diff options
Diffstat (limited to 'Source/WebCore/html/parser/XSSAuditorDelegate.cpp')
| -rw-r--r-- | Source/WebCore/html/parser/XSSAuditorDelegate.cpp | 45 |
1 files changed, 20 insertions, 25 deletions
diff --git a/Source/WebCore/html/parser/XSSAuditorDelegate.cpp b/Source/WebCore/html/parser/XSSAuditorDelegate.cpp index d06069b31..2cbe9bbb8 100644 --- a/Source/WebCore/html/parser/XSSAuditorDelegate.cpp +++ b/Source/WebCore/html/parser/XSSAuditorDelegate.cpp @@ -1,5 +1,6 @@ /* * Copyright (C) 2013 Google, Inc. All Rights Reserved. + * Copyright (C) 2017 Apple Inc. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions @@ -26,8 +27,6 @@ #include "config.h" #include "XSSAuditorDelegate.h" -#include "Console.h" -#include "DOMWindow.h" #include "Document.h" #include "DocumentLoader.h" #include "FormData.h" @@ -36,7 +35,6 @@ #include "FrameLoaderClient.h" #include "HTMLParserIdioms.h" #include "PingLoader.h" -#include "SecurityOrigin.h" #include <inspector/InspectorValues.h> #include <wtf/text/StringBuilder.h> #include <wtf/text/CString.h> @@ -47,49 +45,46 @@ namespace WebCore { XSSAuditorDelegate::XSSAuditorDelegate(Document& document) : m_document(document) - , m_didSendNotifications(false) { ASSERT(isMainThread()); } -static inline String buildConsoleError(const XSSInfo& xssInfo, const String& url) +static inline String buildConsoleError(const XSSInfo& xssInfo) { StringBuilder message; - message.append("The XSS Auditor "); + message.appendLiteral("The XSS Auditor "); message.append(xssInfo.m_didBlockEntirePage ? "blocked access to" : "refused to execute a script in"); - message.append(" '"); - message.append(url); - message.append("' because "); + message.appendLiteral(" '"); + message.append(xssInfo.m_originalURL); + message.appendLiteral("' because "); message.append(xssInfo.m_didBlockEntirePage ? "the source code of a script" : "its source code"); - message.append(" was found within the request."); + message.appendLiteral(" was found within the request."); - if (xssInfo.m_didSendCSPHeader) - message.append(" The server sent a 'Content-Security-Policy' header requesting this behavior."); - else if (xssInfo.m_didSendXSSProtectionHeader) - message.append(" The server sent an 'X-XSS-Protection' header requesting this behavior."); + if (xssInfo.m_didSendXSSProtectionHeader) + message.appendLiteral(" The server sent an 'X-XSS-Protection' header requesting this behavior."); else - message.append(" The auditor was enabled as the server sent neither an 'X-XSS-Protection' nor 'Content-Security-Policy' header."); + message.appendLiteral(" The auditor was enabled because the server did not send an 'X-XSS-Protection' header."); return message.toString(); } -PassRefPtr<FormData> XSSAuditorDelegate::generateViolationReport() +Ref<FormData> XSSAuditorDelegate::generateViolationReport(const XSSInfo& xssInfo) { ASSERT(isMainThread()); - FrameLoader& frameLoader = m_document.frame()->loader(); + auto& frameLoader = m_document.frame()->loader(); String httpBody; if (frameLoader.documentLoader()) { - if (FormData* formData = frameLoader.documentLoader()->originalRequest().httpBody()) + if (auto* formData = frameLoader.documentLoader()->originalRequest().httpBody()) httpBody = formData->flattenToString(); } - RefPtr<InspectorObject> reportDetails = InspectorObject::create(); - reportDetails->setString("request-url", m_document.url().string()); + auto reportDetails = InspectorObject::create(); + reportDetails->setString("request-url", xssInfo.m_originalURL); reportDetails->setString("request-body", httpBody); - RefPtr<InspectorObject> reportObject = InspectorObject::create(); - reportObject->setObject("xss-report", reportDetails.release()); + auto reportObject = InspectorObject::create(); + reportObject->setObject("xss-report", WTFMove(reportDetails)); return FormData::create(reportObject->toJSONString().utf8().data()); } @@ -98,7 +93,7 @@ void XSSAuditorDelegate::didBlockScript(const XSSInfo& xssInfo) { ASSERT(isMainThread()); - m_document.addConsoleMessage(JSMessageSource, ErrorMessageLevel, buildConsoleError(xssInfo, m_document.url().string())); + m_document.addConsoleMessage(MessageSource::JS, MessageLevel::Error, buildConsoleError(xssInfo)); FrameLoader& frameLoader = m_document.frame()->loader(); if (xssInfo.m_didBlockEntirePage) @@ -110,11 +105,11 @@ void XSSAuditorDelegate::didBlockScript(const XSSInfo& xssInfo) frameLoader.client().didDetectXSS(m_document.url(), xssInfo.m_didBlockEntirePage); if (!m_reportURL.isEmpty()) - PingLoader::sendViolationReport(m_document.frame(), m_reportURL, generateViolationReport()); + PingLoader::sendViolationReport(*m_document.frame(), m_reportURL, generateViolationReport(xssInfo), ViolationReportType::XSSAuditor); } if (xssInfo.m_didBlockEntirePage) - m_document.frame()->navigationScheduler().scheduleLocationChange(m_document.securityOrigin(), SecurityOrigin::urlWithUniqueSecurityOrigin(), String()); + m_document.frame()->navigationScheduler().schedulePageBlock(m_document); } } // namespace WebCore |