<rdar://problem/25340377>

Created attachment 274841 [details] Patch

Created attachment 274843 [details] Patch Actually add file ContentSecurityPolicyDirective.cpp and rebase patch.

We likely can further clean up the code in ContentSecurityPolicy and remove duplication. I will look to do such clean up either as part of the fix for bug #114317 or in a subsequent bug/patch.

Created attachment 274845 [details] Patch

Created attachment 274846 [details] Patch

Comment on attachment 274846 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=274846&action=review I got worried you might have a copy/paste error, but looking further I think it was written as intended. r=me. > Source/WebCore/page/csp/ContentSecurityPolicy.cpp:270 > + return isReportOnly; This section seems identical to the code in 'allowJavaScriptURLs". Is this intentional? Why is the error name and all other feature of this "inline event hander" case the same as the "allow JavaScript URLs" case? And if they are identical, why keep both methods? > Source/WebCore/page/csp/ContentSecurityPolicy.cpp:-437 > - ASSERT(!m_frame || effectiveDirective == "frame-ancestors"); Yay!

(In reply to comment #7) > Comment on attachment 274846 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=274846&action=review > > I got worried you might have a copy/paste error, but looking further I think > it was written as intended. r=me. > > > Source/WebCore/page/csp/ContentSecurityPolicy.cpp:270 > > + return isReportOnly; > > This section seems identical to the code in 'allowJavaScriptURLs". Is this > intentional? Yes, this was intentional for the moment. I initially planned to change the error message text for an inline event handler violation in a subsequent patch because this patch was already large and I thought we might need to update the expected results for many tests. As it turns out, we have only three tests for inline event handlers (maybe we can add more?). So, its seems reasonable to simply change the error message for an inline event handler violation in this patch before landing and include updated results for those three affected tests. Before I land this patch I will change line 256 in the patch (attachment #274846 [details]) from: String consoleMessage = consoleMessageForViolation(ContentSecurityPolicyDirectiveNames::scriptSrc, *violatedDirective, URL(), "Refused to execute a script", "its hash, its nonce, or 'unsafe-inline'"); to String consoleMessage = consoleMessageForViolation(ContentSecurityPolicyDirectiveNames::scriptSrc, *violatedDirective, URL(), "Refused to execute a script for an inline event handler", "'unsafe-inline'"); Then we will emit the following error message for an inline event handler violation when the policy defines directive script-src and does not define directive default-src: Refused to execute a script for an inline event handler because 'unsafe-inline' does not appear in the script-src directive of the Content Security Policy. And we will emit the following error message for an inline event handler violation when the policy does not define directive script-src and does define directive default-src: Refused to execute a script for an inline event handler because 'unsafe-inline' appears in neither the script-src directive nor the default-src directive of the Content Security Policy.

Committed r198657: <http://trac.webkit.org/changeset/198657>