Bug 69294 – Move ContentSecurityPolicy to the ScriptExecutionContext to prepare it for working with XHR and workers

• Component: New Bugs
• Status: RESOLVED FIXED

[Sam Weinig]

Move ContentSecurityPolicy to the ScriptExecutionContext to prepare it for working with XHR and workers

[Sam Weinig]

Created attachment 109535 [details]
Patch

[Darin Adler]

Comment on attachment 109535 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=109535&action=review

> Source/WebCore/dom/ScriptExecutionContext.h:178
>          // Note: It is dangerous to change the security origin of a script context
>          //       that already contains content.
>          void setSecurityOrigin(PassRefPtr<SecurityOrigin>);
> +        void setContentSecurityPolicy(PassRefPtr<ContentSecurityPolicy>);

Paragraphing here is a little strange since the comment above is about the security origin, not the content security policy.

[Adam Barth]

Comment on attachment 109535 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=109535&action=review

> Source/WebCore/workers/WorkerContext.cpp:120
> +    // FIXME: This should probably adopt the ContentSecurityPolicy of the document
> +    // that created this worker. 

There was some discussion about this in the working group.  The other choice is to use the header that comes with the script.

[Sam Weinig]

Committed r96550: <http://trac.webkit.org/changeset/96550>