nsIContentSecurityPolicy 编辑

content/base/public/nsIContentSecurityPolicy.idlScriptable Describes an XPCOM component used to model and enforce Content Security Policies. 1.0 66 Introduced Gecko 2.0 Inherits from: nsISupports Last changed in Gecko 2.0 (Firefox 4 / Thunderbird 3.3 / SeaMonkey 2.1)

Method overview

boolean permitsAncestry(in nsIDocShell docShell);

void refinePolicy(in AString policyString, in nsIURI selfURI);

void scanRequestData(in nsIHttpChannel aChannel);

void sendReports(in AString blockedURI, in AString violatedDirective);

short shouldLoad(in unsigned long aContentType, in nsIURI aContentLocation, in nsIURI aRequestOrigin, in nsISupports aContext, in ACString aMimeTypeGuess, in nsISupports aExtra);

short shouldProcess(in unsigned long aContentType, in nsIURI aContentLocation, in nsIURI aRequestOrigin, in nsISupports aContext, in ACString aMimeType, in nsISupports aExtra);

Attributes

Attribute	Type	Description
allowsEval	boolean	Whether this policy allows eval and eval-like functions such as setTimeout("code string", time). Calls to this may trigger violation reports when queried, so this value should not be cached. Read only.
allowsInlineScript	boolean	Whether this policy allows in-page script. Calls to this may trigger violation reports when queried, so this value should not be cached. Read only.
isInitialized	boolean	Set to true when the Content Security Policy has been read in and parsed and is ready to enforce. This is a barrier for the nsDocument so it doesn't load any sub-content until either it knows that a Content Security Policy is ready or will not be used.
policy	AString	A read-only string version of the policy for debugging. Read only.
reportOnlyMode	boolean	When set to true, content load-blocking and fail-closed are disabled: Content Security Policy will only send reports, and not modify behavior.

Methods

permitsAncestry()

Verifies ancestry as permitted by the policy.

Calls to this may trigger violation reports when queried, so this value should not be cached.

boolean permitsAncestry(
  in nsIDocShell docShell
);

Parameters

docShell

Containing the protected resource.

Return value

true if the frame's ancestors are all permitted by policy.

refinePolicy()

Updates the policy currently stored in the Content Security Policy to be "refined" or tightened by the one specified in the string policyString.

void refinePolicy(
  in AString policyString,
  in nsIURI selfURI
);

Parameters

policyString

selfURI

scanRequestData()

Called after the Content Security Policy object is created to fill in the appropriate request and request header information needed in case a report needs to be sent.

void scanRequestData(
  in nsIHttpChannel aChannel
);

Parameters

aChannel

sendReports()

Manually triggers violation report sending given a URI and reason. The URI may be null, in which case "self" is sent.

void sendReports(
  in AString blockedURI,
  in AString violatedDirective
);

Parameters

blockedURI

The URI that violated the policy.

violatedDirective

The directive that was violated.

shouldLoad()

Delegate method called by the service when sub-elements of the protected document are being loaded. Given a bit of information about the request, decides whether or not the policy is satisfied.

Calls to this may trigger violation reports when queried, so this value should not be cached.

short shouldLoad(
  in unsigned long aContentType,
  in nsIURI aContentLocation,
  in nsIURI aRequestOrigin,
  in nsISupports aContext,
  in ACString aMimeTypeGuess,
  in nsISupports aExtra
);

Parameters

aContentType

aContentLocation

aRequestOrigin

aContext

aMimeTypeGuess

aExtra

Return value

 

shouldProcess()

Delegate method called by the service when sub-elements of the protected document are being processed. Given a bit of information about the request, decides whether or not the policy is satisfied.

short shouldProcess(
  in unsigned long aContentType,
  in nsIURI aContentLocation,
  in nsIURI aRequestOrigin,
  in nsISupports aContext,
  in ACString aMimeType,
  in nsISupports aExtra
);

Parameters

aContentType

aContentLocation

aRequestOrigin

aContext

aMimeType

aExtra

Return value