Get rid of the static list of URLs in chrome_url_data_manager_backend.cc which controlled security headers. Instead specify this data through the URLDataSource and WebUIDataSource interfaces. This is needed so that webui pages can be implemented in different modules (i.e. content, chrome, chromeos), so chrome_url_data_manager_backend.cc will move to content and won't know about every type of webui page.

BUG=169170
Review URL: https://codereview.chromium.org/12041014

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@178040 0039d316-1c4b-4281-b951-d872f2087c98

3 files changed, 50 insertions, 0 deletions

diff --git a/content/public/browser/url_data_source.cc b/content/public/browser/url_data_source.cc
index da0e508..f9164ca 100644
--- a/content/public/browser/url_data_source.cc
+++ b/content/public/browser/url_data_source.cc
@@ -21,4 +21,20 @@ bool URLDataSource::AllowCaching() const {
   return true;
 }
 
+bool URLDataSource::ShouldAddContentSecurityPolicy() const {
+  return true;
+}
+
+std::string URLDataSource::GetContentSecurityPolicyObjectSrc() const {
+  return "object-src 'none';";
+}
+
+std::string URLDataSource::GetContentSecurityPolicyFrameSrc() const {
+  return "frame-src 'none';";
+}
+
+bool URLDataSource::ShouldDenyXFrameOptions() const {
+  return true;
+}
+
 }  // namespace content
diff --git a/content/public/browser/url_data_source.h b/content/public/browser/url_data_source.h
index 84b0e3a..4e37b8e 100644
--- a/content/public/browser/url_data_source.h
+++ b/content/public/browser/url_data_source.h
@@ -49,6 +49,8 @@ class CONTENT_EXPORT URLDataSource {
   // string to specify no mime type.
   virtual std::string GetMimeType(const std::string& path) const = 0;
 
+  // The following methods are all called on the IO thread.
+
   // Returns the MessageLoop on which the delegate wishes to have
   // StartDataRequest called to handle the request for |path|. The default
   // implementation returns BrowserThread::UI. If the delegate does not care
@@ -69,6 +71,27 @@ class CONTENT_EXPORT URLDataSource {
 
   // Returns true if responses from this URLDataSource can be cached.
   virtual bool AllowCaching() const;
+
+  // If you are overriding this, then you have a bug.
+  // It is not acceptable to disable content-security-policy on chrome:// pages
+  // to permit functionality excluded by CSP, such as inline script.
+  // Instead, you must go back and change your WebUI page so that it is
+  // compliant with the policy. This typically involves ensuring that all script
+  // is delivered through the data manager backend. Talk to tsepez for more
+  // info.
+  virtual bool ShouldAddContentSecurityPolicy() const;
+
+  // It is OK to override the following two methods to a custom CSP directive
+  // thereby slightly reducing the protection applied to the page.
+
+  // By default, "object-src 'none';" is added to CSP. Override to change this.
+  virtual std::string GetContentSecurityPolicyObjectSrc() const;
+  // By default, "frame-src 'none';" is added to CSP. Override to change this.
+  virtual std::string GetContentSecurityPolicyFrameSrc() const;
+
+  // By default, the "X-Frame-Options: DENY" header is sent. To stop this from
+  // happening, return false. It is OK to return false as needed.
+  virtual bool ShouldDenyXFrameOptions() const;
 };
 
 }  // namespace content
diff --git a/content/public/browser/web_ui_data_source.h b/content/public/browser/web_ui_data_source.h
index da9e7c7..b28d014 100644
--- a/content/public/browser/web_ui_data_source.h
+++ b/content/public/browser/web_ui_data_source.h
@@ -64,6 +64,17 @@ class WebUIDataSource {
 
   // Allows a caller to add a filter for URL requests.
   virtual void SetRequestFilter(const HandleRequestCallback& callback) = 0;
+
+  // The following map to methods on URLDataSource. See the documentation there.
+  // NOTE: it's not acceptable to call DisableContentSecurityPolicy for new
+  // pages, see URLDataSource::ShouldAddContentSecurityPolicy and talk to
+  // tsepez.
+  virtual void DisableContentSecurityPolicy() = 0;
+  virtual void OverrideContentSecurityPolicyObjectSrc(
+      const std::string& data) = 0;
+  virtual void OverrideContentSecurityPolicyFrameSrc(
+      const std::string& data) = 0;
+  virtual void DisableDenyXFrameOptions() = 0;
 };
 
 }  // namespace content