1/* 2 * Copyright (C) 2010 Google Inc. All rights reserved. 3 * 4 * Redistribution and use in source and binary forms, with or without 5 * modification, are permitted provided that the following conditions are 6 * met: 7 * 8 * * Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * * Redistributions in binary form must reproduce the above 11 * copyright notice, this list of conditions and the following disclaimer 12 * in the documentation and/or other materials provided with the 13 * distribution. 14 * * Neither the name of Google Inc. nor the names of its 15 * contributors may be used to endorse or promote products derived from 16 * this software without specific prior written permission. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 20 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 21 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 22 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 23 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 24 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 28 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 29 */ 30 31#include "config.h" 32#include "core/workers/AbstractWorker.h" 33 34#include "bindings/v8/ExceptionState.h" 35#include "core/dom/ExceptionCode.h" 36#include "core/dom/ExecutionContext.h" 37#include "core/frame/csp/ContentSecurityPolicy.h" 38#include "platform/weborigin/SecurityOrigin.h" 39 40namespace WebCore { 41 42AbstractWorker::AbstractWorker(ExecutionContext* context) 43 : ActiveDOMObject(context) 44{ 45} 46 47AbstractWorker::~AbstractWorker() 48{ 49} 50 51KURL AbstractWorker::resolveURL(const String& url, ExceptionState& exceptionState) 52{ 53 // FIXME: This should use the dynamic global scope (bug #27887) 54 KURL scriptURL = executionContext()->completeURL(url); 55 if (!scriptURL.isValid()) { 56 exceptionState.throwDOMException(SyntaxError, "'" + url + "' is not a valid URL."); 57 return KURL(); 58 } 59 60 // We can safely expose the URL in the following exceptions, as these checks happen synchronously before redirection. JavaScript receives no new information. 61 if (!executionContext()->securityOrigin()->canRequest(scriptURL)) { 62 exceptionState.throwSecurityError("Script at '" + scriptURL.elidedString() + "' cannot be accessed from origin '" + executionContext()->securityOrigin()->toString() + "'."); 63 return KURL(); 64 } 65 66 if (executionContext()->contentSecurityPolicy() && !executionContext()->contentSecurityPolicy()->allowWorkerContextFromSource(scriptURL)) { 67 exceptionState.throwSecurityError("Access to the script at '" + scriptURL.elidedString() + "' is denied by the document's Content Security Policy."); 68 return KURL(); 69 } 70 71 return scriptURL; 72} 73 74} // namespace WebCore 75