Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(2)

Unified Diff: third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp

Issue 2436003002: CSP: Add 'script-sample' to violation reports. (Closed)
Patch Set: Rebase Created 3 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp
diff --git a/third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp b/third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp
index 2b9f40057a2b74025ae10f1f6e96f1cd077d72a7..0e6de1c98f8bee463858e81b46144f3908c5a6ab 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp
@@ -252,12 +252,16 @@ bool ScriptController::executeScriptIfJavaScriptURL(const KURL& url,
if (!url.protocolIsJavaScript())
return false;
+ const int javascriptSchemeLength = sizeof("javascript:") - 1;
+ String scriptSource = decodeURLEscapeSequences(url.getString())
+ .substring(javascriptSchemeLength);
+
bool shouldBypassMainWorldContentSecurityPolicy =
ContentSecurityPolicy::shouldBypassMainWorld(frame()->document());
if (!frame()->page() ||
(!shouldBypassMainWorldContentSecurityPolicy &&
!frame()->document()->contentSecurityPolicy()->allowJavaScriptURLs(
- element, frame()->document()->url(),
+ element, scriptSource, frame()->document()->url(),
eventHandlerPosition().m_line))) {
return true;
}
@@ -270,16 +274,13 @@ bool ScriptController::executeScriptIfJavaScriptURL(const KURL& url,
Document* ownerDocument = frame()->document();
- const int javascriptSchemeLength = sizeof("javascript:") - 1;
-
bool locationChangeBefore =
frame()->navigationScheduler().locationChangePending();
- String decodedURL = decodeURLEscapeSequences(url.getString());
v8::HandleScope handleScope(isolate());
v8::Local<v8::Value> result = evaluateScriptInMainWorld(
- ScriptSourceCode(decodedURL.substring(javascriptSchemeLength)),
- NotSharableCrossOrigin, DoNotExecuteScriptWhenScriptsDisabled);
+ ScriptSourceCode(scriptSource), NotSharableCrossOrigin,
+ DoNotExecuteScriptWhenScriptsDisabled);
// If executing script caused this frame to be removed from the page, we
// don't want to try to replace its document!

Powered by Google App Engine
This is Rietveld 408576698