Home | History | Annotate | Download | only in workers 
      1 /*
      2  * Copyright (C) 2010 Google Inc. All rights reserved.
      3  *
      4  * Redistribution and use in source and binary forms, with or without
      5  * modification, are permitted provided that the following conditions are
      6  * met:
      7  *
      8  *     * Redistributions of source code must retain the above copyright
      9  * notice, this list of conditions and the following disclaimer.
     10  *     * Redistributions in binary form must reproduce the above
     11  * copyright notice, this list of conditions and the following disclaimer
     12  * in the documentation and/or other materials provided with the
     13  * distribution.
     14  *     * Neither the name of Google Inc. nor the names of its
     15  * contributors may be used to endorse or promote products derived from
     16  * this software without specific prior written permission.
     17  *
     18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
     19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
     20  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
     21  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
     22  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
     23  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
     24  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     25  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     26  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     27  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
     28  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     29  */
     30 
     31 #include "config.h"
     32 #include "core/workers/AbstractWorker.h"
     33 
     34 #include "bindings/core/v8/ExceptionState.h"
     35 #include "core/dom/ExceptionCode.h"
     36 #include "core/dom/ExecutionContext.h"
     37 #include "core/frame/csp/ContentSecurityPolicy.h"
     38 #include "platform/weborigin/SecurityOrigin.h"
     39 
     40 namespace blink {
     41 
     42 AbstractWorker::AbstractWorker(ExecutionContext* context)
     43     : ActiveDOMObject(context)
     44 {
     45 }
     46 
     47 AbstractWorker::~AbstractWorker()
     48 {
     49 }
     50 
     51 KURL AbstractWorker::resolveURL(const String& url, ExceptionState& exceptionState)
     52 {
     53     // FIXME: This should use the dynamic global scope (bug #27887)
     54     KURL scriptURL = executionContext()->completeURL(url);
     55     if (!scriptURL.isValid()) {
     56         exceptionState.throwDOMException(SyntaxError, "'" + url + "' is not a valid URL.");
     57         return KURL();
     58     }
     59 
     60     // We can safely expose the URL in the following exceptions, as these checks happen synchronously before redirection. JavaScript receives no new information.
     61     if (!executionContext()->securityOrigin()->canRequest(scriptURL)) {
     62         exceptionState.throwSecurityError("Script at '" + scriptURL.elidedString() + "' cannot be accessed from origin '" + executionContext()->securityOrigin()->toString() + "'.");
     63         return KURL();
     64     }
     65 
     66     if (executionContext()->contentSecurityPolicy() && !executionContext()->contentSecurityPolicy()->allowWorkerContextFromSource(scriptURL)) {
     67         exceptionState.throwSecurityError("Access to the script at '" + scriptURL.elidedString() + "' is denied by the document's Content Security Policy.");
     68         return KURL();
     69     }
     70 
     71     return scriptURL;
     72 }
     73 
     74 } // namespace blink
     75