Attachment #382990 for bug #493857

Attachment #382990: CSP Work in Progress (v2) for bug #493857

View | Details | Raw Unified | Return to bug 493857
Collapse All | Expand All





/* ***** BEGIN LICENSE BLOCK *****
 * Version: MPL 1.1/GPL 2.0/LGPL 2.1
 *
 * The contents of this file are subject to the Mozilla Public License Version
 * 1.1 (the "License"); you may not use this file except in compliance with
 * the License. You may obtain a copy of the License at
 * http://www.mozilla.org/MPL/
 *
 * Software distributed under the License is distributed on an "AS IS" basis,
 * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
 * for the specific language governing rights and limitations under the
 * License.
 *
 * The Original Code is the nsCSPContentPolicy service.
 *
 * The Initial Developer of the Original Code is
 *   Sid Stamm <sid@mozilla.com>
 *
 * Contributor(s):
 *   Brandon Sterne <bsterne@mozilla.com>
 *
 * Alternatively, the contents of this file may be used under the terms of
 * either the GNU General Public License Version 2 or later (the "GPL"), or
 * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
 * in which case the provisions of the GPL or the LGPL are applicable instead
 * of those above. If you wish to allow use of your version of this file only
 * under the terms of either the GPL or the LGPL, and not to allow others to
 * use your version of this file under the terms of the MPL, indicate your
 * decision by deleting the provisions above and replace them with the notice
 * and other provisions required by the GPL or the LGPL. If you do not delete
 * the provisions above, a recipient may use your version of this file under
 * the terms of any one of the MPL, the GPL or the LGPL.
 *
 * ***** END LICENSE BLOCK ***** */

#include "nsISupports.idl"
#include "nsIURI.idl"

/**
 * IContentSecurityPolicy  
 * Describes an XPCOM component used to model an enforce CSPs.
 */

[scriptable, uuid(AB36A2BF-CB32-4AA6-AB41-6B4E4444A221)]
interface IContentSecurityPolicy : nsISupports
{

  /**
   * Set to true when the CSP has been read in and parsed and is ready to
   * enforce.  This is a barrier for the nsDocument so it doesn't load any
   * sub-content until either it knows that a CSP is ready or will not be used.
   */
  attribute boolean isInitialized;

  /**
   * A read-only string version of the policy for debugging.
   */
  readonly attribute AString policy;

  void refinePolicy(in AString policyString);

  /**
   * Delegate method called by the service when sub-elements of the protected
   * document are being loaded.  Given a bit of information about the request,
   * decides whether or not the policy is satisfied.
   */
  short shouldLoad(in unsigned long   aContentType, 
                   in nsIURI          aContentLocation, 
                   in nsIURI          aRequestOrigin, 
                   in nsISupports     aContext, 
                   in ACString        aMimeTypeGuess, 
                   in nsISupports     aExtra);

  /**
   * Delegate method called by the service when sub-elements of the protected
   * document are being processed.  Given a bit of information about the request,
   * decides whether or not the policy is satisfied.
   */
  short shouldProcess(in unsigned long   aContentType, 
                      in nsIURI          aContentLocation, 
                      in nsIURI          aRequestOrigin, 
                      in nsISupports     aContext, 
                      in ACString        aMimeType,
                      in nsISupports     aExtra);

};

(-)a/caps/idl/Makefile.in (+1 lines)

Line	Link Here

Lines 45-56 include $(DEPTH)/config/autoconf.mk	Link Here

MODULE		= caps

MODULE		= caps

GRE_MODULE	= 1

GRE_MODULE	= 1

XPIDLSRCS	= \

XPIDLSRCS	= \

		nsIScriptSecurityManager.idl \

		nsIScriptSecurityManager.idl \

		nsIPrincipal.idl \

		nsIPrincipal.idl \

		nsISignatureVerifier.idl \

		nsISignatureVerifier.idl \

		nsISecurityCheckedComponent.idl \

		nsISecurityCheckedComponent.idl \

		IContentSecurityPolicy.idl \

		$(NULL)

		$(NULL)

include $(topsrcdir)/config/rules.mk

include $(topsrcdir)/config/rules.mk





/* ***** BEGIN LICENSE BLOCK *****
 * Version: MPL 1.1/GPL 2.0/LGPL 2.1
 *
 * The contents of this file are subject to the Mozilla Public License Version
 * 1.1 (the "License"); you may not use this file except in compliance with
 * the License. You may obtain a copy of the License at
 * http://www.mozilla.org/MPL/
 *
 * Software distributed under the License is distributed on an "AS IS" basis,
 * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
 * for the specific language governing rights and limitations under the
 * License.
 *
 * The Original Code is the Content Security Policy data structures.
 *
 * The Initial Developer of the Original Code is
 * Sid Stamm <sid@mozilla.com>
 *
 * Contributor(s):
 *
 * Alternatively, the contents of this file may be used under the terms of
 * either the GNU General Public License Version 2 or later (the "GPL"), or
 * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
 * in which case the provisions of the GPL or the LGPL are applicable instead
 * of those above. If you wish to allow use of your version of this file only
 * under the terms of either the GPL or the LGPL, and not to allow others to
 * use your version of this file under the terms of the MPL, indicate your
 * decision by deleting the provisions above and replace them with the notice
 * and other provisions required by the GPL or the LGPL. If you do not delete
 * the provisions above, a recipient may use your version of this file under
 * the terms of any one of the MPL, the GPL or the LGPL.
 *
 * ***** END LICENSE BLOCK ***** */


/**
 * Content Security Policy Utilities
 * 
 * Overview
 * This contains a set of classes and utilities for CSP.  It is in this
 * separate file for testing purposes.
 */

// Module stuff
var EXPORTED_SYMBOLS = ["CSPRep", "CSPSourceList", "CSPSource", 
                        "CSPHost", "CSPWarning", "CSPError"];

function CSPWarning(aMsg) {
  //customize this to redirect output.
  aMsg = 'CSP WARN:  ' + aMsg;
  dump(aMsg);
  Components.classes["@mozilla.org/consoleservice;1"]
                    .getService(Components.interfaces.nsIConsoleService)
                    .logStringMessage(aMsg);
}
function CSPError(aMsg) {
  aMsg = 'CSP ERROR: ' + aMsg;
  dump(aMsg);
  Components.classes["@mozilla.org/consoleservice;1"]
                    .getService(Components.interfaces.nsIConsoleService)
                    .logStringMessage(aMsg);
}
function debug(aMsg) {
  aMsg = 'CSP debug: ' + aMsg;
  dump(aMsg);
  Components.classes["@mozilla.org/consoleservice;1"]
                    .getService(Components.interfaces.nsIConsoleService)
                    .logStringMessage(aMsg);
}


//:::::::::::::::::::::::: CLASSES ::::::::::::::::::::::::::// 

/**
 * Class that represents a parsed policy structure.
 */
function CSPRep() {
  // this gets set to true when the policy is done parsing, or when a
  // URI-borne policy has finished loading.
  this._isInitialized = false;

  // don't auto-populate _directives, so it is easier to find bugs
  this._directives = {};

}
CSPRep.SRC_DIRECTIVES = {
  ALLOW:            "allow",
  SCRIPT_SRC:       "script-src",
  STYLE_SRC:        "style-src",
  MEDIA_SRC:        "media-src",
  IMG_SRC:          "img-src",
  OBJECT_SRC:       "object-src",
  FRAME_SRC:        "frame-src",
  FRAME_ANCESTORS:  "frame-ancestors"
};
CSPRep.URI_DIRECTIVES = {
  REPORT_URI:       "report-uri",
  POLICY_URI:       "policy-uri"
};


/**
  * Factory to create a new CSPRep, parsed from a string.
  *
  * @param aStr
  *        string rep of a CSP
  * @param self (optional)
  *        string or CSPSource representing the "self" source
  * @returns
  *        an instance of CSPRep
  */
CSPRep.fromString = function(aStr, self) {
  var SD = CSPRep.SRC_DIRECTIVES;
  var UD = CSPRep.URI_DIRECTIVES;
  var pieces = aStr.split(/;\s*/);
  var aCSPR = new CSPRep();
  piece:for(var i in pieces) {
    //split off first token and figure out what to do
    var dirname = pieces[i].match(/(\S+)/)[0];

    //careful to trim the stuff so there's no extra tokens 
    var dirvalue = pieces[i].substring(dirname.length)
                            .replace(/^\s+/,'')
                            .replace(/\s+$/,'');

    //is it a SRC directive?
    for(var sdi in SD) {
      if(dirname == SD[sdi]) {
        var dv = CSPSourceList.fromString(dirvalue, self);
        //TODO: more robust check for errors in making DV
        aCSPR._directives[SD[sdi]] = dv;
        continue piece;
      }
    }

    //not a SRC directive, check URI directives
    if(dirname == UD.POLICY_URI) {
      // POLICY_URI can only be alone
      if(aCSPR._directives.length > 0 || pieces.length > 1) {
        CSPError("policy-uri directive can only appear alone");
        return CSPRep.fromString("allow none");
      }

      //TODO: verify that policy URI is same-origin
      var req = Cc["@mozilla.org/xmlextras/xmlhttprequest;1"]  
                  .createInstance(Ci.nsIXMLHttpRequest);  

      req.onerror = CSPError;

      // synchronous -- otherwise we need to architect a callback into the
      // xpcom component so that whomever creates the policy object gets
      // notified when it's loaded and ready to go.
      req.open("GET", dirvalue, false);
      //debug("Fetching URI " + dirvalue);
      req.send(null);  
      if(req.status == 200) {
        //debug("XHR returned: " + req.responseText);
        aCSPR = CSPRep.fromString(req.responseText, self);
        //remember where we got the policy
        aCSPR._directives[UD.POLICY_URI] = dirvalue;
        return aCSPR;
      }
      CSPError("Error fetching policy URI: server response was " + req.status);
      return CSPRep.fromString("allow none");
    }
    if(dirname == UD.REPORT_URI) {
      //TODO: do we want to support multiple URIs?
      //TODO: verify that report URI(s) is(are) same-origin
      aCSPR._directives[UD.REPORT_URI] = dirvalue;
      continue piece;
    }

    //no directives matched
    CSPWarning("Couldn't process unknown directive '" + dirname + "'");
  }

  if(aCSPR._directives.length < 1) {
    CSPError("invalid policy -- no recognized directives");
    return CSPRep.fromString("allow none");
  }

  if(!aCSPR._directives[SD.ALLOW]) {
    CSPWarning("allow directive is not present, using 'allow none'");
    aCSPR._directives[SD.ALLOW] = CSPSourceList.fromString("none");
  }

  aCSPR.makeExplicit();
  return aCSPR;
};

CSPRep.prototype = {
  /**
   * Returns array of all report uris defined, or none if there are none.
   */
  getReportURIs:
  function() {
    if(!this._directives[CSPRep.URI_DIRECTIVES.REPORT_URI])
      return [];

    var uris = this._directives[CSPRep.URI_DIRECTIVES.REPORT_URI].split(",");
    for(let i in uris) {
      //trim off surrounding whitespace
      uris[i] = uris[i].replace(/^\s+/, "").replace(/\s+$/, "");
    }
    return uris;
  },

  /**
   * Compares this CSPRep instance to another.
   */
  equals:
  function(that) {
    if(this._directives.length != that._directives.length) {
      return false;
    }
    for(var i in this._directives) {
      if(!that._directives[i] || !this._directives[i].equals(that._directives[i])) {
        return false;
      }
    }
    return true;
  },

  /**
   * Generates string representation of the policy.  Should be fairly similar
   * to the original.
   */
  toString:
  function csp_toString() {
    var dirs = [];
    for(var i in this._directives) {
      if(this._directives[i]) {
        dirs.push(i + " " + this._directives[i].toString());
      }
    }
    return dirs.join("; ");
  },


  /**
   * Determines if this directive accepts a URI.
   * @param aContext
   *        one of the SRC_DIRECTIVES defined above
   * @returns 
   *        true if the policy permits the URI in given context.
   */
  permits:
  function csp_permits(aURI, aContext) {
    //make sure the context is valid
    for(var i in CSPRep.SRC_DIRECTIVES) {
      if(CSPRep.SRC_DIRECTIVES[i] == aContext) {
        return this._directives[aContext].permits(aURI);
      }
    }
    return false;
  },

  /**
   * Intersects with another CSPRep, deciding the subset policy 
   * that should be enforced, and returning a new instance.
   * @param aCSPRep
   *        a CSPRep instance to use as "other" CSP
   * @returns
   *        a new CSPRep instance of the intersection
   */
  intersectWith:
  function cspsd_intersectWith(aCSPRep) {
    var newRep = new CSPRep();

    for(var dir in CSPRep.SRC_DIRECTIVES) {
      var dirv = CSPRep.SRC_DIRECTIVES[dir];
      newRep._directives[dirv] = this._directives[dirv]
               .intersectWith(aCSPRep._directives[dirv]);
    }
    return newRep;
  },


  /**
   * Copies default source list to each unspecified directive.
   * @returns
   *      true  if the makeExplicit succeeds
   *      false if it fails (for some weird reason)
   */
  makeExplicit:
  function cspsd_makeExplicit() {
    var SD = CSPRep.SRC_DIRECTIVES;
    var allowDir = this._directives[SD.ALLOW];
    if(!allowDir) {
      return false;
    }

    for(var dir in SD) {
      var dirv = SD[dir];
      if(dirv == SD.ALLOW) {
        continue;
      }
      if(!this._directives[dirv]) {
        //implicit directive, make explicit
        this._directives[dirv] = allowDir.clone();
      }
    }
    this._isInitialized = true;
    return true;
  }
};


//////////////////////////////////////////////////////////////////////
/**
 * Class to represent a list of sources 
 */
function CSPSourceList() {
  this._sources = [];
  this._permitAllSources = false;
}

/**
 * Factory to create a new CSPSourceList, parsed from a string.
 *
 * @param aStr
 *        string rep of a CSP Source List
 * @param self (optional)
 *        string or CSPSource representing the "self" source
 * @returns
 *        an instance of CSPSourceList 
 */
CSPSourceList.fromString = function(aStr, self) {
  //Source list is:
  //    <host-dir-value> ::= <source-list>
  //                       | "none"
  //    <source-list>    ::= <source>
  //                       | <source-list>" "<source>

  var slObj = new CSPSourceList();
  if(aStr == "none") {
    return slObj;
  }

  var ss = aStr.split(/\s+/);
  for(var i in ss) {
    var o = CSPSource.fromString(ss[i], self);
    //make sure none came back undefined
    if(!o) { return null; }
    slObj._sources[i] = o;
  }
  return slObj;
};

CSPSourceList.prototype = {

  /**
   * Compares one CSPSourceList to another.
   *
   * @param that
   *        another CSPSourceList
   * @returns 
   *        true if they have the same data
   */
  equals:
  function(that) {
    if(that._sources.length != this._sources.length) {
      return false;
    }
    //sort both arrays and compare like a zipper
    //XXX (sid): I think we can make this more efficient
    var sortfn = function(a,b) {
      return a.toString() > b.toString();
    };
    var a_sorted = this._sources.sort(sortfn);
    var b_sorted = that._sources.sort(sortfn);
    for(var i in a_sorted) {
      if(!a_sorted[i].equals(b_sorted[i])) {
        return false;
      }
    }
    return true;
  },

  /**
   * Generates string representation of the Source List.
   * Should be fairly similar to the original.
   */
  toString:
  function() {
    if(this.isNone()) {
      return "none";
    }
    return this._sources.map(function(x) { return x.toString(); }).join(" ");
  },

  /**
   * Returns whether or not this source list represents the "none" special
   * case.
   */
  isNone:
  function() {
    return (!this._permitAllSources) && (this._sources.length < 1);
  },

  /**
   * Makes a new instance that resembles this object.
   * @returns
   *      a new CSPSourceList
   */
  clone:
  function() {
    var aSL = new CSPSourceList();
    aSL._permitAllSources = this._permitAllSources;
    for(var i in this._sources) {
      aSL._sources[i] = this._sources[i].clone();
    }
    return aSL;
  },


  /**
   * Determines if this directive accepts a URI.
   * @param aURI
   *        the URI in question
   * @returns
   *        true if the URI matches a source in this source list.
   */
  permits:
  function cspsd_matches(aURI) {
    if(this.isNone()) {
      return false;
    }
    for(var i in this._sources) {
      if(this._sources[i].permits(aURI)) {
        return true;
      }
    }
    return false;
  },


  /**
   * Intersects with another CSPSourceList, deciding the subset directive
   * that should be enforced, and returning a new instance.
   * @param that 
   *        the other CSPSourceList to intersect "this" with
   * @returns
   *        a new instance of a CSPSourceList representing the intersection
   */
  intersectWith:
  function cspsd_intersectWith(that) {
    if(this._permitAllSources) {
      return that.clone();
    }
    if(that._permitAllSources) {
      return this.clone();
    }

    // "none" case
    if(this.isNone() || that.isNone()) {
      return CSPSourceList.fromString("none");
    }

    // --  find only common sources

    //XXX (sid): figure out a good algorithm for this.
    // This is horribly inefficient. O(n^2)
    var isrcs = [];
    for(var i in this._sources) {
      for(var j in that._sources) {
        var s = that._sources[j].intersectWith(this._sources[i]);
        if(s) {
          isrcs.push(s);
        }
      }
    }
    //Next, remove duplicates
    dup:for(var i = 0; i < isrcs.length; i++) {
      for(var j = 0; j < i; j++) {
        if(isrcs[i].equals(isrcs[j])) {
          isrcs.splice(i, 1);
          i--;
          continue dup;
        }
      }
    }
    var newCSPSrcList = new CSPSourceList();
    newCSPSrcList._sources = isrcs;
    return newCSPSrcList;
  }
}


//////////////////////////////////////////////////////////////////////
/**
 * Class to model a source (scheme, host, port)
 */
function CSPSource() {
  this._scheme = "*";
  this._port = "*";
  this._host = "*";
}

CSPSource._PORT_RE = /(:(\*|\d+))$/;
CSPSource._SCHM_RE = /^((\*|[a-zA-Z][a-zA-Z\+\.\-]*):\/{0,2})/;
CSPSource._HOST_RE = /^(localhost|\*|(((\*|[a-zA-Z0-9\-]+)\.)([a-zA-Z0-9\-]+\.)*([a-zA-Z0-9\-]+)))$/;

/**
 * Factory to create a new CSPSource, parsed from a string.
 *
 * @param aStr
 *        string rep of a CSP Source
 * @param self (optional)
 *        string or CSPSource representing the "self" source
 * @returns
 *        an instance of CSPSource 
 */
CSPSource.fromString = function(aStr, self) {
  if(aStr == "self") {
    if(!self) {
      CSPError("self keyword used, but no self data specified");
      return null;
    } 
    if(self == "self") {
      CSPError("self reference cannot be 'self'");
      return null;
    }
    if(self instanceof CSPSource) { 
      return self.clone();
    }
    return CSPSource.fromString(self);
  }

  var s = aStr;
  var sObj = new CSPSource();

  if(self && !(self instanceof CSPSource)) {
    self = CSPSource.fromString(self);
  }

  // IMPORTANT: scan for port first, because host can be mistaken for scheme
  // due to the allowance of dots in the scheme (and a colon before the port)
  if(CSPSource._PORT_RE.test(s)) {
    sObj._port = s.match(CSPSource._PORT_RE)[0].replace(/:/,'');
    s = s.replace(CSPSource._PORT_RE, '');
  } else if(self) {
    sObj._port = self._port;
  }

  if(CSPSource._SCHM_RE.test(s)) {
    sObj._scheme = s.match(CSPSource._SCHM_RE)[0].replace(/[:\/]+/,'');
    s = s.replace(CSPSource._SCHM_RE, '');
  } else if(self) {
    sObj._scheme = self._scheme;
  }

  
  if(CSPSource._HOST_RE.test(s)) {
    sObj._host = CSPHost.fromString(s.match(CSPSource._HOST_RE)[0]);
    if(sObj._host) {
      return sObj;
    }
  } 
  CSPError("failed parsing host: '" + s + "'");
  return null;
};

CSPSource.prototype = {

  /**
   * Generates string representation of the Source.
   * Should be fairly similar to the original.
   */
  toString:
  function() {
    var s = this._host;
    if(this._port && this._port != "*") {
      s = s + ":" + this._port;
    }
    if(this._scheme && this._scheme != "*") {
      s = this._scheme + "://" + s;
    }
    return s;
  },

  /**
   * Makes a new instance that resembles this object.
   * @returns
   *      a new CSPSource
   */
  clone:
  function() {
    var aClone = new CSPSource();
    aClone._scheme = this._scheme;
    aClone._port = this._port;
    aClone._host = this._host.clone();
    return aClone;
  },

  /**
   * Determines if this Source accepts a URI.
   * @param aURI
   *        the URI in question
   * @returns
   *        true if the URI matches a source in this source list.
   */
  permits:
  function(aSource) {
    if(!(aSource instanceof CSPSource)) {
      //convert to CSPSource first
      return this.permits(CSPSource.fromString(aSource));
    }

    //verify scheme, host, and port
    if(    (this._scheme == "*" || this._scheme == aSource._scheme)
        && (this._port == "*"   || this._port == aSource._port)    ){
      return this._host.permits(aSource._host);
    }
    // something didn't match.
    return false;
  },

  /**
   * Determines the intersection of two sources.
   * Returns a null object if intersection generates no
   * hosts that satisfy it.
   * @param that 
   *        the other CSPSource to intersect "this" with
   * @returns
   *        a new instance of a CSPSource representing the intersection
   */
  intersectWith:
  function(that) {
    var newSource = new CSPSource();

    //port
    if(this._port == "*") { 
      newSource._port = that._port;
    } else if(that._port == "*") { 
      newSource._port = this._port;
    } else if(that._port == this._port) {
      newSource._port = this._port;
    } else {
      //CSPError("Could not intersect " + this + " with " + that
      //         + " due to port problems.");
      return null;
    }

    //scheme
    if(this._scheme == "*") { 
      newSource._scheme = that._scheme;
    } else if(that._scheme == "*") { 
      newSource._scheme = this._scheme;
    } else if(that._scheme == this._scheme) {
      newSource._scheme = this._scheme;
    } else {
      //CSPError("Could not intersect " + this + " with " + that
      //         + " due to scheme problems.");
      return null;
    }

    //host
    newSource._host = this._host.intersectWith(that._host);

    return newSource._host ? newSource : null;
  },

  /**
   * Compares one CSPSource to another.
   *
   * @param that
   *        another CSPSource
   * @returns 
   *        true if they have the same data
   */
  equals:
  function(aSrc) {
    return this._scheme == aSrc._scheme
        && this._port == aSrc._port
        && this._host.equals(aSrc._host);
  }
};
  

//////////////////////////////////////////////////////////////////////
/**
 * Class to model a host *.x.y.
 */
function CSPHost() {
  this._segments = [];
}

/**
 * Factory to create a new CSPHost, parsed from a string.
 *
 * @param aStr
 *        string rep of a CSP Host 
 * @returns
 *        an instance of CSPHost
 */
CSPHost.fromString = function(aStr) {
  var hObj = new CSPHost();
  hObj._segments = aStr.split(/\./);
  if(hObj._segments.length < 1 ||
     hObj._segments.length == 1 && hObj._segments[0] != "*"
                                && hObj._segments[0] != "localhost") {
    //only short hosts allowed are "*" and "localhost"
    return null;
  }
  //TODO: double-check that each segment is appropriate.
  return hObj;
};

CSPHost.prototype = {
  /**
   * Generates string representation of the Source.
   * Should be fairly similar to the original.
   */
  toString:
  function() {
    return this._segments.join(".");
  },

  /**
   * Makes a new instance that resembles this object.
   * @returns
   *      a new CSPHost
   */
  clone:
  function() {
    var aHost = new CSPHost();
    for(var i in this._segments) {
      aHost._segments[i] = this._segments[i];
    }
    return aHost;
  },

  /**
   * Returns true if this host accepts the provided host (or the other way
   * around).
   * @param aHost
   *        the FQDN in question (CSPHost or String)
   * @returns
   */
  permits:
  function(aHost) {
    if(!(aHost instanceof CSPHost)) {
      // -- compare CSPHost to String
      return this.permits(CSPHost.fromString(aHost));
    }
    var thislen = this._segments.length;
    var thatlen = aHost._segments.length;

    // don't accept a less specific host: 
    //   \--> *.b.a doesn't accept b.a.
    if(thatlen < thislen) { return false; }

    // check for more specific host (and wildcard):
    //   \--> *.b.a accepts d.c.b.a.
    //   \--> c.b.a doesn't accept d.c.b.a.
    if((thatlen > thislen) && this._segments[0] != "*") {
      return false;
    }

    // Given the wildcard condition (from above), 
    // only necessary to compare elements that are present
    // in this host.  Extra tokens in aHost are ok. 
    // * Compare from right to left.
    for(var i=1; i <= thislen; i++) {
      if( this._segments[thislen-i] != "*" && 
          (this._segments[thislen-i] != aHost._segments[thatlen-i]) ) {
        return false;
      }
    }

    //at this point, all conditions are met, so the host is allowed
    return true;
  },

  /**
   * Determines the intersection of two Hosts.
   * Basically, they must be the same, or one must have a wildcard.
   * @param that 
   *        the other CSPHost to intersect "this" with
   * @returns
   *        a new instance of a CSPHost representing the intersection
   *        (or null, if they can't be intersected)
   */
  intersectWith:
  function(that) {
    if(!(this.permits(that) || that.permits(this))) {
      // host definitions cannot co-exist without a more general host
      // ... one must be a subset of the other, or intersection makes no sense.
      return null;
    } 

    // pick the more specific one, if both are same length.
    if(this._segments.length == that._segments.length) {
      // *.a vs b.a : b.a
      return (this._segments[0] == "*") ? that.clone() : this.clone();
    }

    //different lengths...
    // *.b.a vs *.a : *.b.a
    // *.b.a vs d.c.b.a : d.c.b.a
    return (this._segments.length > that._segments.length) 
            ? this.clone() : that.clone();
  },

  /**
   * Compares one CSPHost to another.
   *
   * @param that
   *        another CSPHost
   * @returns 
   *        true if they have the same data
   */
  equals:
  function(that) {
    if(this._segments.length != that._segments.length) {
      return false;
    }
    for(var i=0; i<this._segments.length; i++) {
      if(this._segments[i] != that._segments[i]) {
        return false;
      }
    }
    return true;
  }
};






EXTRA_DSO_LDOPTS = \
		$(LIBS_DIR) \
		$(ZLIB_LIBS) \
		$(MOZ_JS_LIBS) \
		$(MOZ_COMPONENT_LIBS) \
		$(NULL)

EXTRA_PP_COMPONENTS = \
		contentSecurityPolicy.js \
		$(NULL)

EXTRA_JS_MODULES = \
		CSPUtils.jsm \
		$(NULL)


include $(topsrcdir)/config/rules.mk

INCLUDES	+= -I$(srcdir)/../include






/* ***** BEGIN LICENSE BLOCK *****
 * Version: MPL 1.1/GPL 2.0/LGPL 2.1
 *
 * The contents of this file are subject to the Mozilla Public License Version
 * 1.1 (the "License"); you may not use this file except in compliance with
 * the License. You may obtain a copy of the License at
 * http://www.mozilla.org/MPL/
 *
 * Software distributed under the License is distributed on an "AS IS" basis,
 * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
 * for the specific language governing rights and limitations under the
 * License.
 *
 * The Original Code is the Content Security Policy Data Structures testing code.
 *
 * The Initial Developer of the Original Code is
 * Sid Stamm <sid@mozilla.com>
 *
 * Contributor(s):
 *
 * Alternatively, the contents of this file may be used under the terms of
 * either the GNU General Public License Version 2 or later (the "GPL"), or
 * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
 * in which case the provisions of the GPL or the LGPL are applicable instead
 * of those above. If you wish to allow use of your version of this file only
 * under the terms of either the GPL or the LGPL, and not to allow others to
 * use your version of this file under the terms of the MPL, indicate your
 * decision by deleting the provisions above and replace them with the notice
 * and other provisions required by the GPL or the LGPL. If you do not delete
 * the provisions above, a recipient may use your version of this file under
 * the terms of any one of the MPL, the GPL or the LGPL.
 *
 * ***** END LICENSE BLOCK ***** */

/**
 * Tester for CSPUtils.jsm 
 * Launch me with xpcshell.
 **/

//make dump rhino-friendly
var dump = print;

//import "CSPUtils.jsm" ;
load('CSPUtils.jsm');
load('../../netwerk/test/httpserver/httpd.js');

var g_SHOW_PASSES = false;
var failedTests = [];
var g_tests = 0;
var g_passed = 0;

function test(codeThunk, expectedResult) {
  var x;
  g_tests++;
  try {
    x = codeThunk();
  } catch(e) {
    x = e;
  }
  var success = false;
  if(expectedResult == undefined) {
    success = (x == undefined);
  } else if(expectedResult instanceof Function) {
    success = expectedResult(x);
  } else {
    success = (x == expectedResult);
  }

  if(success) {
    if(g_SHOW_PASSES) { print("  pass   :: " + codeThunk.name); }
    g_passed++;
  } else {
    print(" [FAIL]  :: in " + codeThunk.name + ": " + x);
    print(x.stack);
  }
}

function ASSERT(foo, message) {
  if(!foo) {
    throw message;
  }
}

function ASSERT_NOT_NULL(foo, message) {
  if(foo == null) {
    throw message;
  }
}

function ASSERT_NULL(foo, message) {
  if(foo != null) {
    throw message;
  }
}

// NOTE: this is the object version of ASSERT_EQ
function ASSERT_EQUALS(foo, bar, message) {
  if(!foo.equals(bar)) {
    throw message;
  }
}

function ASSERT_EQ(foo, bar, message) {
  if(foo != bar) {
    throw message;
  }
}
function ASSERT_NEQ(foo, bar, message) {
  if(foo == bar) {
    throw message;
  }
}

function ASSERT_HAS_KEY(foo, key, message) {
  for(var x in foo) {
    if(x == key) { return; }
  }
  throw message;
}
function ASSERT_HAS_VALUE(foo, val, message) {
  for(var x in foo) {
    if(foo[x] == val) { return; }
  }
  throw message;
}

// END OF TESTING LIBRARY
////////////////////////////////////////////////////////////



// Begin Actual Tests

// setup
const POLICY_FROM_URI = "allow self; img-src *";
const POLICY_URI = "http://localhost:3400/policy";
var httpServer = new nsHttpServer();
function policyresponder(request,response) {
  response.setStatusLine(request.httpVersion, 200, "OK");
  response.setHeader("Content-Type", "text/csp", false);
  response.write(POLICY_FROM_URI);
}
//server.registerDirectory("/", nsILocalFileForBasePath);
httpServer.registerPathHandler("/policy", policyresponder);
httpServer.start(3400);
       


///////// TEST THE CSPHost object ////////////////////////
test(
  function test_CSPHost_fromstring() {
    var h;

    h = CSPHost.fromString("*");
    ASSERT_NOT_NULL(h, "* lone wildcard should work");

    h = CSPHost.fromString("foo.bar");
    ASSERT_NOT_NULL(h, "standard tuple failed");

    h = CSPHost.fromString("*.bar");
    ASSERT_NOT_NULL(h, "wildcard failed");

    h = CSPHost.fromString("com");
    ASSERT_NULL(h, "lone symbol should fail");

    h = CSPHost.fromString("f00b4r.com");
    ASSERT_NOT_NULL(h, "Numbers in hosts should work");

    h = CSPHost.fromString("foo-bar.com");
    ASSERT_NOT_NULL(h, "dashes in hosts should work");

    // Not enforced in CSPHost
    //h = CSPHost.fromString("foo!bar.com");
    //ASSERT_NULL(h, "special chars in hosts should fail");
  });

test(
  function test_CSPHost_clone() {
    h = CSPHost.fromString("*.a.b.c");
    h2 = h.clone();
    for(var i in h._segments) {
      ASSERT_EQ(h._segments[i], h2._segments[i], "cloned segments should match");
    }
  });

test(
  function test_CSPHost_permits() {
    var h = CSPHost.fromString("*.b.c");
    var h2 = CSPHost.fromString("a.b.c");
    ASSERT( h.permits(h2),      "CSPHost *.b.c should allow CSPHost a.b.c")
    ASSERT( h.permits("a.b.c"), "CSPHost *.b.c should allow string a.b.c")
    ASSERT(!h.permits("b.c"),   "CSPHost *.b.c should not allow string b.c")
    ASSERT(!h.permits("a.a.c"), "CSPHost *.b.c should not allow string a.a.c")

    ASSERT(!h2.permits(h),      "CSPHost a.b.c should not allow CSPHost *.b.c")
    ASSERT(!h2.permits("b.c"),  "CSPHost a.b.c should not allow string b.c")
    ASSERT( h2.permits("a.b.c"),"CSPHost a.b.c should allow string a.b.c")
  });

test(
    function test_CSPHost_intersectWith() {
      var h = CSPHost.fromString("*.b.c");
      ASSERT_EQ("*.a.b.c", h.intersectWith(CSPHost.fromString("*.a.b.c")),
                "*.a.b.c ^ *.b.c should be *.a.b.c");
      ASSERT_NULL(h.intersectWith(CSPHost.fromString("*.d.e")), 
                  "*.b.c ^ *.d.e should not work (null)");
    });

///////////////////// Test the Source object //////////////////////

test(
    function test_CSPSource_fromString() {
      ASSERT_NOT_NULL(CSPSource.fromString("a.com"),
                      "basic source should not be null.");

      ASSERT_NOT_NULL(CSPSource.fromString("a2-c.com"),
                      "ldh characters should all work for host.");

      ASSERT_NOT_NULL(CSPSource.fromString("*.a.com"),
                      "wildcard should work in first token for host.");

      print(" --- Ignore the following two errors if they print ---");
      ASSERT_NULL(CSPSource.fromString("x.*.a.com"),
                  "wildcard should not work in non-first token for host.");

      ASSERT_NULL(CSPSource.fromString("a#2-c.com"),
                  "funny characters (#) should not work for host, _HOST_RE is probably broken.");
      print(" --- Stop ignoring errors that print ---\n");

      ASSERT_NOT_NULL(CSPSource.fromString("a.com:23"),
                      "failed to parse host with port.");
      ASSERT_NOT_NULL(CSPSource.fromString("https://a.com"),
                      "failed to parse host with scheme.");
      ASSERT_NOT_NULL(CSPSource.fromString("https://a.com:200"),
                      "failed to parse host with scheme and port.");
    });

test(
    function test_CSPSource_fromString_withSelf() {
      var src;
      src = CSPSource.fromString("a.com", "https://self.com");
      ASSERT(src.permits("https://a.com:443"),
             "src should inherit port *");
      ASSERT(!src.permits("http://a.com"),
              "src should inherit and require https scheme");
      ASSERT(src.permits("https://a.com"),
             "src should inherit scheme 'https'"); 
      
      src = CSPSource.fromString("self", "https://self.com");
      ASSERT(src.permits("https://self.com:443"),
             "src should inherit port *");
      ASSERT(!src.permits("http://self.com"),
              "src should inherit and require https scheme");
      ASSERT(src.permits("https://self.com"),
             "src should inherit scheme 'https'"); 
      ASSERT(!src.permits("https://a.com"),
              "src should reject other hosts"); 
    });

///////////////////// Test the source list //////////////////////

test(
    function test_CSPSourceList_fromString() {
      var sd = CSPSourceList.fromString("none");
      ASSERT_NOT_NULL(sd, "'none' -- should parse");
      ASSERT_EQ(0, sd._sources.length, "'none' should be a zero-length list");

      sd = CSPSourceList.fromString("*");
      ASSERT_EQ(1, sd._sources.length, "'*' should be a one-length list");

      print(" --- Ignore the following three errors if they print ---");
      ASSERT_NULL(CSPSourceList.fromString("f!oo.bar"),
                  "funny char in host");
      ASSERT_NULL(CSPSourceList.fromString("ht1ps://f-oo.bar"),
                  "funny char in scheme");
      ASSERT_NULL(CSPSourceList.fromString("https://f-oo.bar:3f"),
                  "funny char in port");
      print(" --- Stop ignoring errors that print ---\n");
    });

test(
    function test_CSPSourceList_fromString_twohost() {
      var str = "foo.bar:21 https://ras.bar";
      var sd = CSPSourceList.fromString(str);
      ASSERT_NOT_NULL(sd, "two-host list should parse");
      ASSERT_EQ(2, sd._sources.length, 
                "two-host list should parse to two hosts");
      ASSERT_EQ(str, sd.toString(),
                "two-host list should contain original data");
    });

test(
    function test_CSPSourceList_permits() {
      var nullSourceList = CSPSourceList.fromString("none");
      var simpleSourceList = CSPSourceList.fromString("a.com");
      var doubleSourceList = CSPSourceList.fromString("https://foo.com http://bar.com:88");
      var allSourceList = CSPSourceList.fromString("*");

      ASSERT( !nullSourceList.permits("a.com"),
              "'none' should permit none.")
      ASSERT( simpleSourceList.permits("a.com"),
              "a.com should permit a.com");
      ASSERT( !simpleSourceList.permits("b.com"),
              "wrong host");
      ASSERT( doubleSourceList.permits("http://bar.com:88"), 
              "double list permits http://bar.com:88");
      ASSERT( !doubleSourceList.permits("https://bar.com:88"), 
              "double list permits https://bar.com:88");
      ASSERT( !doubleSourceList.permits("http://bar.com:443"), 
              "double list does not permit http://bar.com:443");
      ASSERT( doubleSourceList.permits("https://foo.com:88"), 
              "double list permits https://foo.com:88");
      ASSERT( !doubleSourceList.permits("foo.com"), 
              "double list does not permit foo.com");

      ASSERT( allSourceList.permits("http://x.com:23"),
              "* does not permit specific host");
      ASSERT( allSourceList.permits("http://a.b.c.d.e.f.x.com"),
              "* does not permit a long host with no port");

    });

test(
    function test_CSPSourceList_intersect() {
      var nullSourceList = CSPSourceList.fromString("none");
      var simpleSourceList = CSPSourceList.fromString("a.com");
      var doubleSourceList = CSPSourceList.fromString("https://foo.com http://bar.com:88");
      var singleFooSourceList = CSPSourceList.fromString("https://foo.com");
      var allSourceList = CSPSourceList.fromString("*");

      ASSERT(nullSourceList.intersectWith(simpleSourceList).isNone(),
             "Intersection of one source with 'none' source list should be none.");
      ASSERT(nullSourceList.intersectWith(doubleSourceList).isNone(),
             "Intersection of two sources with 'none' source list should be none.");
      ASSERT(nullSourceList.intersectWith(allSourceList).isNone(),
             "Intersection of '*' with 'none' source list should be none.");

      ASSERT_EQUALS(allSourceList.intersectWith(simpleSourceList), simpleSourceList,
             "Intersection of one source with '*' source list should be one source.");
      ASSERT_EQUALS(allSourceList.intersectWith(doubleSourceList), doubleSourceList,
             "Intersection of two sources with '*' source list should be two sources.");

      ASSERT(simpleSourceList.intersectWith(doubleSourceList).isNone(),
             "Non-overlapping source lists should intersect to 'none'");

      ASSERT_EQUALS(singleFooSourceList,
                    doubleSourceList.intersectWith(singleFooSourceList),
                    "subset and superset should intersect to subset.");

      //TODO: write more tests?

    });

///////////////////// Test the Whole CSP rep object //////////////////////

test(
    function test_CSPRep_fromString() {

      // check default init
      //ASSERT(!(new CSPRep())._isInitialized, "Uninitialized rep thinks it is.")

      var cspr;
      var cspr_allowval;

      // check default policy "allow *"
      cspr = CSPRep.fromString("allow *");
      ASSERT_HAS_KEY(cspr._directives, CSPRep.SRC_DIRECTIVES.ALLOW,
                     "ALLOW directive is missing when specified in fromString");

      // ... and check that the other directives were auto-filled with the
      // ALLOW one.
      var SD = CSPRep.SRC_DIRECTIVES;
      cspr_allowval = cspr._directives[SD.ALLOW];
      for(var d in CSPRep.SRC_DIRECTIVES) {
        ASSERT_HAS_KEY(cspr._directives, SD[d], "Missing key " + d);
        ASSERT_EQ(cspr._directives[SD[d]].toString(), cspr_allowval.toString(),
                  "Implicit directive " + d + " has non-allow value.");
      }
    });


test(
    function test_CSPRep_fromString_oneDir() {

      var cspr;
      var SD = CSPRep.SRC_DIRECTIVES;
      var DEFAULTS = [SD.STYLE_SRC, SD.MEDIA_SRC, SD.IMG_SRC,
                      SD.FRAME_ANCESTORS, SD.FRAME_SRC];

      // check one-directive policies
      cspr = CSPRep.fromString("allow bar.com; script-src https://foo.com");

      for(var x in DEFAULTS) {
        ASSERT(cspr.permits("http://bar.com:22", DEFAULTS[x]), 
              DEFAULTS[x] + " does not use default rule.");
        ASSERT(!cspr.permits("https://foo.com:400", DEFAULTS[x]), 
              DEFAULTS[x] + " does not use default rule.");
      }
      ASSERT(!cspr.permits("http://bar.com:22", SD.SCRIPT_SRC), 
             "script-src false positive in policy.");
      ASSERT(cspr.permits("https://foo.com:400", SD.SCRIPT_SRC), 
             "script-src false negative in policy.");
    });

test(
    function test_CSPRep_fromString_twodir() {
      var cspr;
      var SD = CSPRep.SRC_DIRECTIVES;
      var DEFAULTS = [SD.STYLE_SRC, SD.MEDIA_SRC, SD.FRAME_ANCESTORS, SD.FRAME_SRC];

      // check two-directive policies
      cspr = CSPRep.fromString("allow allow.com; "
                             + "script-src https://foo.com; "
                             + "img-src bar.com");
      for(var x in DEFAULTS) {
        ASSERT(cspr.permits("http://allow.com:22", DEFAULTS[x]), 
              DEFAULTS[x] + " does not use default rule.");
        ASSERT(!cspr.permits("https://foo.com:400", DEFAULTS[x]), 
              DEFAULTS[x] + " does not use default rule.");
        ASSERT(!cspr.permits("http://bar.com:400", DEFAULTS[x]), 
              DEFAULTS[x] + " does not use default rule.");
      }
      ASSERT(!cspr.permits("http://allow.com:22", SD.IMG_SRC), 
            "img-src does not use default rule.");
      ASSERT(!cspr.permits("https://foo.com:400", SD.IMG_SRC), 
            "img-src does not use default rule.");
      ASSERT(cspr.permits("http://bar.com:400", SD.IMG_SRC), 
            "img-src does not use default rule.");

      ASSERT(!cspr.permits("http://allow.com:22", SD.SCRIPT_SRC), 
            "script-src does not use default rule.");
      ASSERT(cspr.permits("https://foo.com:400", SD.SCRIPT_SRC), 
            "script-src does not use default rule.");
      ASSERT(!cspr.permits("http://bar.com:400", SD.SCRIPT_SRC), 
            "script-src does not use default rule.");
    });

test(function test_CSPRep_fromString_withself() {
       var cspr;
       var SD = CSPRep.SRC_DIRECTIVES;
       var self = "https://self.com:34";

       // check one-directive policies
       cspr = CSPRep.fromString("allow self; script-src self https://*:*",
                                self);
      ASSERT(!cspr.permits("https://foo.com:400", SD.IMG_SRC), 
             "img-src does not enforce default rule, 'self'.");
      ASSERT(cspr.permits(self, SD.IMG_SRC), 
             "img-src does not allow self");
      ASSERT(!cspr.permits("http://evil.com", SD.SCRIPT_SRC), 
             "script-src is too relaxed");
      ASSERT(cspr.permits(self, SD.SCRIPT_SRC), 
             "script-src should allow self");
      ASSERT(cspr.permits("https://evil.com:100", SD.SCRIPT_SRC), 
             "script-src is too strict on host/port");
     });

///////////////////// TEST POLICY_URI //////////////////////
// TODO: set up a mock server and serve the policy URI
test(function test_CSPRep_fromPolicyURI() {
        var cspr;
        var SD = CSPRep.SRC_DIRECTIVES;
        var self = "http://localhost:3400";

        cspr = CSPRep.fromString("policy-uri " + POLICY_URI, self);
        cspr_static = CSPRep.fromString(POLICY_FROM_URI, self);

        ASSERT_NOT_NULL(cspr, "policy-uri failed to load");

        // other directives inherit self
        for(var i in SD) {
          ASSERT_EQUALS(cspr._directives[SD[i]],
                        cspr_static._directives[SD[i]],
                        SD[i] + " parsed wrong from policy uri");
        }
    });

test(function test_CSPRep_fromPolicyURI_failswhenmixed() {
        var cspr;
        var self = "http://localhost:3400";
        var closed_policy = CSPRep.fromString("allow none");
        var my_uri_policy = "policy-uri http://localhost:3400/policy";

        print(" --- Ignore the following two errors if they print ---");
        cspr = CSPRep.fromString("allow *; " + my_uri_policy, self);
        ASSERT_EQUALS(cspr, closed_policy,
                      "Parsing should fail when 'policy-uri' " +
                      "is mixed with allow directive");
        cspr = CSPRep.fromString("img-src self; " + my_uri_policy, self);
        ASSERT_EQUALS(cspr, closed_policy,
                      "Parsing should fail when 'policy-uri' " +
                      "is mixed with other directives");
        print(" --- Stop ignoring errors that print ---\n");

    });



///////////////////// END TESTING //////////////////////

//teardown
httpServer.stop(function() { });

if(g_passed < g_tests)  {
  print(g_tests + " tests run: " + g_passed + " passed, " + (g_tests-g_passed) + " failure(s).");
} else {
  print("All " + g_tests + " tests passed.");
}





/* ***** BEGIN LICENSE BLOCK *****
 * Version: MPL 1.1/GPL 2.0/LGPL 2.1
 *
 * The contents of this file are subject to the Mozilla Public License Version
 * 1.1 (the "License"); you may not use this file except in compliance with
 * the License. You may obtain a copy of the License at
 * http://www.mozilla.org/MPL/
 *
 * Software distributed under the License is distributed on an "AS IS" basis,
 * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
 * for the specific language governing rights and limitations under the
 * License.
 *
 * The Original Code is the nsCSPContentPolicy service.
 *
 * The Initial Developer of the Original Code is
 * Sid Stamm <sid@mozilla.com>
 *
 * Contributor(s):
 *   Brandon Sterne <bsterne@mozilla.com>
 *
 * Alternatively, the contents of this file may be used under the terms of
 * either the GNU General Public License Version 2 or later (the "GPL"), or
 * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
 * in which case the provisions of the GPL or the LGPL are applicable instead
 * of those above. If you wish to allow use of your version of this file only
 * under the terms of either the GPL or the LGPL, and not to allow others to
 * use your version of this file under the terms of the MPL, indicate your
 * decision by deleting the provisions above and replace them with the notice
 * and other provisions required by the GPL or the LGPL. If you do not delete
 * the provisions above, a recipient may use your version of this file under
 * the terms of any one of the MPL, the GPL or the LGPL.
 *
 * ***** END LICENSE BLOCK ***** */


/**
 * Content Security Policy
 * 
 * Overview
 * This is a stub component that will be fleshed out to do all the fancy stuff
 * that ContentSecurityPolicy has to do.
 */

/* :::::::: Constants and Helpers ::::::::::::::: */

const Cc = Components.classes;
const Ci = Components.interfaces;
const Cr = Components.results;
const Cu = Components.utils;

Cu.import("resource://gre/modules/XPCOMUtils.jsm");
Cu.import("resource://gre/modules/CSPUtils.jsm");

function debug(aMsg) {
  aMsg = ("CSP: " + aMsg).replace(/\S{80}/g, "$&\n");
  dump(aMsg + "\n");
  Cc["@mozilla.org/consoleservice;1"].getService(Ci.nsIConsoleService)
                                     .logStringMessage(aMsg);
}

/* ::::: Policy Parsing & Data structures :::::: */

function ContentSecurityPolicy() {
  debug("CSP CREATED");
  this._isInitialized = false;
  this._policy = CSPRep.fromString("allow *");
  debug("CSP POLICY INITED TO 'allow *'");
}

/*
 * Set up mappings from nsIContentPolicy content types to CSP directives.
 */
with(Ci.nsIContentPolicy) {
  let csp = ContentSecurityPolicy;
  let cspr_sd = CSPRep.SRC_DIRECTIVES;

  csp._MAPPINGS=[];

  /* default, catch-all case */
  csp._MAPPINGS[TYPE_OTHER]             =  cspr_sd.ALLOW;

  /* self */
  csp._MAPPINGS[TYPE_DOCUMENT]          =  null;

  /* shouldn't see this one */
  csp._MAPPINGS[TYPE_REFRESH]           =  null;

  /* categorized content types */
  csp._MAPPINGS[TYPE_SCRIPT]            = cspr_sd.SCRIPT_SRC;
  csp._MAPPINGS[TYPE_IMAGE]             = cspr_sd.IMG_SRC;
  csp._MAPPINGS[TYPE_STYLESHEET]        = cspr_sd.STYLE_SRC;
  csp._MAPPINGS[TYPE_OBJECT]            = cspr_sd.OBJECT_SRC;
  csp._MAPPINGS[TYPE_SUBDOCUMENT]       = cspr_sd.FRAME_SRC;
  csp._MAPPINGS[TYPE_MEDIA]             = cspr_sd.MEDIA_SRC;


  /* These must go through the catch-all */
  csp._MAPPINGS[TYPE_XBL]               = cspr_sd.ALLOW;
  csp._MAPPINGS[TYPE_PING]              = cspr_sd.ALLOW;
  csp._MAPPINGS[TYPE_XMLHTTPREQUEST]    = cspr_sd.ALLOW;
  csp._MAPPINGS[TYPE_OBJECT_SUBREQUEST] = cspr_sd.ALLOW;
  csp._MAPPINGS[TYPE_DTD]               = cspr_sd.ALLOW;
  csp._MAPPINGS[TYPE_FONT]              = cspr_sd.ALLOW;
}

ContentSecurityPolicy.prototype = {
  classDescription: "Content Security Policy Component",
  contractID:       "@mozilla.org/contentsecuritypolicy;1",
  classID:          Components.ID("{AB36A2BF-CB32-4AA6-AB41-6B4E4444A221}"),
  QueryInterface:   XPCOMUtils.generateQI([Ci.IContentSecurityPolicy]),

  // get this contractID registered for certain categories via XPCOMUtils
  _xpcom_categories: [ ],

  get isInitialized() {
    return this._isInitialized;
  },

  set isInitialized (foo) {
    this._isInitialized = foo;
  },

  get policy () {
    return this._policy.toString();
  },

  /*
  // Having a setter is a bad idea... opens up the policy to "loosening"
  // Instead, use "refinePolicy."
  set policy (aStr) {
    this._policy = CSPRep.fromString(aStr);
  },
  */

/* ........ Methods .............. */

  /**
   * Given a new policy, intersects the currently enforced policy with the new
   * one and stores the result.  The effect is a "tightening" or refinement of
   * an old policy.  This is called any time a new policy is encountered and
   * the effective policy has to be refined.
   */
  refinePolicy:
  function csp_refinePolicy(aString) {
    debug("REFINE POLICY: " + aString);

    // stay uninitialized until policy merging is done
    this._isInitialized = false;

    // If there is a policy-uri, fetch the policy, then re-call this function.
    // (1) parse and create a CSPRep object
    var newpolicy = CSPRep.fromString(aString);

    // (2) Intersect the currently installed CSPRep object with the new one
    var intersect = this._policy.intersectWith(newpolicy);
    //TODO: make sure intersect worked
 
    // (3) Save the result
    this._policy = intersect;
    this._isInitialized = true;
  },

  /**
   * Generates and sends a violation report to the specified report URIs.
   */
  sendReports:
  function(blockedUri, victimContext, violatedDirective) {
    var uris = this._policy.getReportURIs();
    if(uris.length > 0) {
      //TODO: generate report to send
      //   ... composed of:
      // <csp-report>
      //   <request>GET /index.html HTTP/1.1</request>
      //   <request-headers>Host: example.com
      //            User-Agent: ...
      //            ...
      //   </request-headers>
      //   <blocked-uri>...</blocked-uri>
      //   <violated-directive>...</violated-directive>
      // </csp-report>
      //   
     
      for(let i in uris) {
        //TODO: asynchronously send report to uris[i]
      }
    }
  },

  /**
   * Delegate method called by the service when sub-elements of the protected
   * document are being loaded.  Given a bit of information about the request,
   * decides whether or not the policy is satisfied.
   */
  shouldLoad:
  function csp_shouldLoad(aContentType, 
                          aContentLocation, 
                          aRequestOrigin, 
                          aContext, 
                          aMimeTypeGuess, 
                          aExtra) {

    //interpret the context, and then pass off to the decision structure
    //debug("shouldLoad content type =" + aContentType);
    var cspContext = ContentSecurityPolicy._MAPPINGS[aContentType];
    //debug("shouldLoad CSP directive =" + cspContext);

    // if the mapping is null, there's no policy, let it through.
    if(!cspContext) {
      return Ci.nsIContentPolicy.ACCEPT;
    }

    // otherwise, honor the translation
    var source = aContentLocation.scheme + "://" + aContentLocation.hostPort; 
    var res = this._policy.permits(source, cspContext)
              ? Ci.nsIContentPolicy.ACCEPT 
              : Ci.nsIContentPolicy.REJECT_SERVER;

    // TODO: frame-ancestors

    // If the result is *NOT* ACCEPT, then send report
    if(res != Ci.nsIContentPolicy.ACCEPT) { 
      debug("blocking request for " + aContentLocation.asciiSpec);
      this.sendReports(aContentLocation,
                       aContext,
                       cspContext + " " + this._policy._directives[cspContext]);
    }

    return res;
  },
  
  shouldProcess:
  function csp_shouldProcess(aContentType,
                             aContentLocation,
                             aRequestOrigin,
                             aContext,
                             aMimeType,
                             aExtra) {
    //TODO: do we need this?
    debug("shouldProcess aContext=" + aContext);
    return true;
  },

};



function NSGetModule(aComMgr, aFileSpec)
  XPCOMUtils.generateModule([ContentSecurityPolicy]);





#include "nsCompatibility.h"
#include "nsTObserverArray.h"
#include "nsTHashtable.h"
#include "nsHashKeys.h"
#include "nsNodeInfoManager.h"
#include "nsIStreamListener.h"
#include "nsIObserver.h"
#include "nsAutoPtr.h"
#include "IContentSecurityPolicy.h"
#ifdef MOZ_SMIL
class nsSMILAnimationController;
#endif // MOZ_SMIL

class nsIContent;
class nsPresContext;
class nsIPresShell;
class nsIDocShell;

                    "have a presentation or a docshell or a window");
    NS_PRECONDITION(aDisplayDocument != this, "Should be different document");
    NS_PRECONDITION(!aDisplayDocument->GetDisplayDocument(),
                    "Display documents should not nest");
    mDisplayDocument = aDisplayDocument;
  }

  /**
   * Return the Content Security Policy object for the document
   */
  IContentSecurityPolicy* GetContentSecurityPolicy() const
  {
    return mCSP;
  }

  /**
   * A class that represents an external resource load that has begun but
   * doesn't have a document yet.  Observers can be registered on this object,
   * and will be notified after the document is created.  Observers registered
   * after the document has been created will NOT be notified.  When observers
   * are notified, the subject will be the newly-created document, the topic
   * will be "external-resource-document-created", and the data will be null.
   * If document creation fails for some reason, observers will still be
   * notified, with a null document pointer.

  PRUint32            mSubtreeModifiedDepth;

  // If we're an external resource document, this will be non-null and will
  // point to our "display document": the one that all resource lookups should
  // go to.
  nsCOMPtr<nsIDocument> mDisplayDocument;

  PRUint32 mEventsSuppressed;

  // CSP policy object/data
  nsCOMPtr<IContentSecurityPolicy> mCSP;
};

NS_DEFINE_STATIC_IID_ACCESSOR(nsIDocument, NS_IDOCUMENT_IID)

/**
 * mozAutoSubtreeModified batches DOM mutations so that a DOMSubtreeModified
 * event is dispatched, if necessary, when the outermost mozAutoSubtreeModified
 * object is deleted.





		nsContentAreaDragDrop.cpp \
		nsContentIterator.cpp \
		nsContentList.cpp \
		nsContentPolicy.cpp \
		nsContentSink.cpp \
		nsContentUtils.cpp \
		nsCopySupport.cpp \
		nsCrossSiteListenerProxy.cpp \
		nsCSPService.cpp \
		nsDataDocumentContentPolicy.cpp \
		nsDOMAttribute.cpp \
		nsDOMAttributeMap.cpp \
		nsDOMDocumentType.cpp \
		nsDOMFile.cpp \
		nsDOMLists.cpp \
		nsDOMParser.cpp \
		nsDOMSerializer.cpp \





/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* ***** BEGIN LICENSE BLOCK *****
 * Version: MPL 1.1/GPL 2.0/LGPL 2.1
 *
 * The contents of this file are subject to the Mozilla Public License Version
 * 1.1 (the "License"); you may not use this file except in compliance with
 * the License. You may obtain a copy of the License at
 * http://www.mozilla.org/MPL/
 *
 * Software distributed under the License is distributed on an "AS IS" basis,
 * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
 * for the specific language governing rights and limitations under the
 * License.
 *
 * The Original Code is mozilla.org code.
 *
 * The Initial Developer of the Original Code is
 * Mozilla Corporation.
 * Portions created by the Initial Developer are Copyright (C) 2009
 * the Initial Developer. All Rights Reserved.
 *
 * Contributor(s):
 *   Brandon Sterne <bsterne@mozilla.com>
 *
 * Alternatively, the contents of this file may be used under the terms of
 * either of the GNU General Public License Version 2 or later (the "GPL"),
 * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
 * in which case the provisions of the GPL or the LGPL are applicable instead
 * of those above. If you wish to allow use of your version of this file only
 * under the terms of either the GPL or the LGPL, and not to allow others to
 * use your version of this file under the terms of the MPL, indicate your
 * decision by deleting the provisions above and replace them with the notice
 * and other provisions required by the GPL or the LGPL. If you do not delete
 * the provisions above, a recipient may use your version of this file under
 * the terms of any one of the MPL, the GPL or the LGPL.
 *
 * ***** END LICENSE BLOCK ***** */

#include "nsIURI.h"
#include "nsString.h"
#include "nsCSPService.h"
#include "nsIDocument.h"
#include "nsIContent.h"
#include "IContentSecurityPolicy.h"

CSPService::CSPService()
{
}

CSPService::~CSPService()
{
}

NS_IMPL_ISUPPORTS1(CSPService, nsIContentPolicy)

/* nsIContentPolicy implementation */
NS_IMETHODIMP
CSPService::ShouldLoad(PRUint32 aContentType,
                       nsIURI *aContentLocation,
                       nsIURI *aRequestOrigin,
                       nsISupports *aRequestContext,
                       const nsACString &aMimeTypeGuess,
                       nsISupports *aExtra,
                       PRInt16 *aDecision)
{
  if (!aContentLocation)
    return NS_ERROR_FAILURE;

  /*
#ifdef DEBUG
  {
    nsCAutoString location("None");
    aContentLocation->GetSpec(location);
    printf(" *** CSPService::ShouldLoad called for %s\n",
           location.get());
  }
#endif
  */

  // find the nsDocument that initiated this request and see if it has a
  // CSP policy object
  nsCOMPtr<nsIDocument> doc;
  nsCOMPtr<nsIContent> node(do_QueryInterface(aRequestContext));
  if (node) {
    doc = node->GetOwnerDoc();
  }
  if (!doc) {
    doc = do_QueryInterface(aRequestContext);
  }
  
  // default decision, CSP can revise it if there's a policy to enforce
  *aDecision = nsIContentPolicy::ACCEPT;
  if (doc) {
    IContentSecurityPolicy* csp = doc->GetContentSecurityPolicy();
    if (csp) {
#ifdef DEBUG
      nsAutoString policy;
      csp->GetPolicy(policy);
      printf(" *** CSPService - document has policy: %s\n",
              ToNewCString(policy));
#endif
      // obtain the enforcement decision
      csp->ShouldLoad(aContentType,
                      aContentLocation,
                      aRequestOrigin,
                      aRequestContext,
                      aMimeTypeGuess,
                      aExtra,
                      aDecision);
    }
  }
#ifdef DEBUG
  else {
    nsCAutoString uriSpec("None");
    aContentLocation->GetSpec(uriSpec);
    printf(" *** CSPService - COULD NOT get nsIDocument for location: %s\n",
            uriSpec.get());
  }
#endif
	
  return NS_OK;
}

NS_IMETHODIMP
CSPService::ShouldProcess(PRUint32         aContentType,
                          nsIURI           *aContentLocation,
                          nsIURI           *aRequestOrigin,
                          nsISupports      *aRequestContext,
                          const nsACString &aMimeTypeGuess,
                          nsISupports      *aExtra,
                          PRInt16          *aDecision)
{
  *aDecision = nsIContentPolicy::ACCEPT;
  return NS_OK;
}





/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* ***** BEGIN LICENSE BLOCK *****
 * Version: MPL 1.1/GPL 2.0/LGPL 2.1
 *
 * The contents of this file are subject to the Mozilla Public License Version
 * 1.1 (the "License"); you may not use this file except in compliance with
 * the License. You may obtain a copy of the License at
 * http://www.mozilla.org/MPL/
 *
 * Software distributed under the License is distributed on an "AS IS" basis,
 * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
 * for the specific language governing rights and limitations under the
 * License.
 *
 * The Original Code is mozilla.org code.
 *
 * The Initial Developer of the Original Code is
 * Mozilla Corporation.
 * Portions created by the Initial Developer are Copyright (C) 2009
 * the Initial Developer. All Rights Reserved.
 *
 * Contributor(s):
 *   Brandon Sterne <bsterne@mozilla.com>
 *
 * Alternatively, the contents of this file may be used under the terms of
 * either of the GNU General Public License Version 2 or later (the "GPL"),
 * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
 * in which case the provisions of the GPL or the LGPL are applicable instead
 * of those above. If you wish to allow use of your version of this file only
 * under the terms of either the GPL or the LGPL, and not to allow others to
 * use your version of this file under the terms of the MPL, indicate your
 * decision by deleting the provisions above and replace them with the notice
 * and other provisions required by the GPL or the LGPL. If you do not delete
 * the provisions above, a recipient may use your version of this file under
 * the terms of any one of the MPL, the GPL or the LGPL.
 *
 * ***** END LICENSE BLOCK ***** */

#include "nsIGenericFactory.h"

#include "nsCOMPtr.h"
#include "nsXPCOM.h"
#include "nsIServiceManager.h"
#include "nsICategoryManager.h"

#include "nsMemory.h"

#include "nsIContentPolicy.h"
#include "nsIObserver.h"

#define CSPSERVICE_CONTRACTID "@mozilla.org/cspservice;1"
#define CSPSERVICE_CID \
{ 0x8d2f40b2, 0x4875, 0x4c95, \
  { 0x97, 0xd9, 0x3f, 0x7d, 0xca, 0x2c, 0xb4, 0x60 } }

class CSPService : public nsIContentPolicy
{
public:
  NS_DECL_ISUPPORTS
  NS_DECL_NSICONTENTPOLICY
  
  CSPService();
  virtual ~CSPService();

private:
  PRBool mEnabled;
};





#include "mozAutoDocUpdate.h"

#ifdef MOZ_SMIL
#include "nsSMILAnimationController.h"
#include "imgIContainer.h"
#include "nsSVGUtils.h"
#endif // MOZ_SMIL

// FOR CSP (autogenerated by xpidl)
#include "IContentSecurityPolicy.h"


#ifdef MOZ_LOGGING
// so we can get logging even in release builds
#define FORCE_PR_LOG 1
#endif
#include "prlog.h"

#ifdef PR_LOGGING

    semicolon = start;
    FindCharInReadable(';', semicolon, end);
    mContentType = Substring(start, semicolon);
  }

  RetrieveRelevantHeaders(aChannel);

  mChannel = aChannel;
  
// --------------  Initialize CSP
  nsresult rv;
  PRBool system;
  nsIScriptSecurityManager *ssm = nsContentUtils::GetSecurityManager();
  nsAutoString cspHeaderValue;
  nsIAtom* cspHeaderAtom = NS_NewAtom("x-content-security-policy");

  this->GetHeaderData(cspHeaderAtom, cspHeaderValue);

  if(NS_SUCCEEDED(ssm->IsSystemPrincipal(NodePrincipal(), &system)) && system) {
    //only makes sense to register new CSP if this document is not priviliged
    return NS_OK;
  }

  if(cspHeaderValue.IsEmpty()) {
    // no CSP header present
    return NS_OK;
  }

#ifdef DEBUG
  printf(" >> *** DOCUMENT specified CSP header!\n");
#endif

  mCSP = do_CreateInstance("@mozilla.org/contentsecuritypolicy;1", &rv);

  if(NS_FAILED(rv)) {
#ifdef DEBUG
    printf("failed to create CSP object: %6x", rv);
#endif
    return rv;
  }

#ifdef DEBUG
  printf(" >> *** CSP Created \"%s\"\n", ToNewCString(cspHeaderValue));
#endif

  // Also start parsing the policy
  mCSP->RefinePolicy(cspHeaderValue);

#ifdef DEBUG
  printf(" >> *** CSP refined.");
#endif
// -------------- CSP initialized

  return NS_OK;
}

void
nsDocument::StopDocumentLoad()
{
  if (mParser) {


    static const char *const headers[] = {
      "default-style",
      "content-style-type",
      "content-language",
      "content-disposition",
      "refresh",
      "x-dns-prefetch-control",
      "x-content-security-policy",
      // add more http headers if you need
      // XXXbz don't add content-location support without reading bug
      // 238654 and its dependencies/dups first.
      0
    };
    
    nsCAutoString headerVal;
    const char *const *name = headers;


void
nsDocument::Destroy()
{
  // The ContentViewer wants to release the document now.  So, tell our content
  // to drop any references to the document so that it can be destroyed.
  if (mIsGoingAway)
    return;
	
  // Take down CSP
  mCSP = 0;

  mIsGoingAway = PR_TRUE;

  RemovedFromDocShell();

  PRUint32 i, count = mChildren.ChildCount();
  for (i = 0; i < count; ++i) {
    mChildren.ChildAt(i)->DestroyContent();





static void Shutdown();

#ifdef MOZ_XTF
#include "nsIXTFService.h"
#include "nsIXMLContentBuilder.h"
#endif

#include "nsGeolocation.h"
#include "nsCSPService.h"

// Transformiix
/* {0C351177-0159-4500-86B0-A219DFDE4258} */
#define TRANSFORMIIX_XPATH1_SCHEME_CID \
{ 0xc351177, 0x159, 0x4500, { 0x86, 0xb0, 0xa2, 0x19, 0xdf, 0xde, 0x42, 0x58 } }

/* 5d5d92cd-6bf8-11d9-bf4a-000a95dc234c */
#define TRANSFORMIIX_NODESET_CID \

NS_GENERIC_FACTORY_CONSTRUCTOR(nsDOMScriptObjectFactory)
NS_GENERIC_FACTORY_CONSTRUCTOR(nsBaseDOMException)

#define NS_GEOLOCATION_SERVICE_CID \
  { 0x404d02a, 0x1CA, 0xAAAB, { 0x47, 0x62, 0x94, 0x4b, 0x1b, 0xf2, 0xf7, 0xb5 } }

NS_GENERIC_FACTORY_SINGLETON_CONSTRUCTOR(nsGeolocationService, nsGeolocationService::GetGeolocationService)

static NS_METHOD
CSPServiceRegistration(nsIComponentManager *aCompMgr,
                       nsIFile *aPath,
                       const char *registryLocation,
                       const char *componentType,
                       const nsModuleComponentInfo *info)
{
  nsresult rv;
  nsCOMPtr<nsIServiceManager> servman = do_QueryInterface((nsISupports*)aCompMgr, &rv);
  if (NS_FAILED(rv))
    return rv;

  nsCOMPtr<nsICategoryManager> catman;
  rv = servman->GetServiceByContractID(NS_CATEGORYMANAGER_CONTRACTID,
                                       NS_GET_IID(nsICategoryManager),
                                       getter_AddRefs(catman));
  if (NS_FAILED(rv))
    return rv;
  
  char* previous = nsnull;
  rv = catman->AddCategoryEntry("xpcom-startup",
                                "CSPService",
                                CSPSERVICE_CONTRACTID,
                                PR_TRUE,
                                PR_TRUE,
                                &previous);
  if (previous)
    nsMemory::Free(previous);

  rv = catman->AddCategoryEntry("content-policy",
                                "CSPService",
                                CSPSERVICE_CONTRACTID,
                                PR_TRUE,
                                PR_TRUE,
                                &previous);
  if (previous)
    nsMemory::Free(previous);

  return rv;
}

static NS_METHOD
CSPServiceUnregistration(nsIComponentManager *aCompMgr,
                         nsIFile *aPath,
                         const char *registryLocation,
                         const nsModuleComponentInfo *info){
  nsresult rv;

  nsCOMPtr<nsIServiceManager> servman = do_QueryInterface((nsISupports*)aCompMgr, &rv);
  if (NS_FAILED(rv))
    return rv;

  nsCOMPtr<nsICategoryManager> catman;
  rv = servman->GetServiceByContractID(NS_CATEGORYMANAGER_CONTRACTID,
                                       NS_GET_IID(nsICategoryManager),
                                       getter_AddRefs(catman));
  if (NS_FAILED(rv))
    return rv;

  rv = catman->DeleteCategoryEntry("xpcom-startup",
                                   "CSPService",
                                   PR_TRUE);

  rv = catman->DeleteCategoryEntry("content-policy",
                                   "CSPService",
                                   PR_TRUE);

  return rv;
}

NS_GENERIC_FACTORY_CONSTRUCTOR(CSPService)

// The list of components we register
static const nsModuleComponentInfo gComponents[] = {
#ifdef DEBUG
  { "Frame utility",
    NS_FRAME_UTIL_CID,
    nsnull,
    CreateNewFrameUtil },
  { "Layout debugger",

      nsTextServicesDocumentConstructor },
#endif

    { "Geolocation Service",
      NS_GEOLOCATION_SERVICE_CID,
      "@mozilla.org/geolocation/service;1",
      nsGeolocationServiceConstructor },

    { "Content Security Policy Service",
      CSPSERVICE_CID,
      CSPSERVICE_CONTRACTID,
      CSPServiceConstructor,
      CSPServiceRegistration,
      CSPServiceUnregistration
    },


  { "Focus Manager",
    NS_FOCUSMANAGER_CID,
    "@mozilla.org/focus-manager;1",
    CreateFocusManager },
};


Return to bug 493857