file_manager_untrusted_ui.cc 2.3 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061
  1. // Copyright 2020 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "ash/webui/file_manager/file_manager_untrusted_ui.h"
  5. #include "ash/webui/file_manager/untrusted_resources/grit/file_manager_untrusted_resources.h"
  6. #include "ash/webui/file_manager/untrusted_resources/grit/file_manager_untrusted_resources_map.h"
  7. #include "ash/webui/file_manager/url_constants.h"
  8. #include "content/public/browser/web_contents.h"
  9. #include "content/public/browser/web_ui.h"
  10. #include "content/public/browser/web_ui_data_source.h"
  11. #include "content/public/common/url_constants.h"
  12. #include "url/gurl.h"
  13. namespace ash {
  14. namespace file_manager {
  15. FileManagerUntrustedUIConfig::FileManagerUntrustedUIConfig()
  16. : WebUIConfig(content::kChromeUIUntrustedScheme,
  17. kChromeUIFileManagerUntrustedHost) {}
  18. FileManagerUntrustedUIConfig::~FileManagerUntrustedUIConfig() = default;
  19. std::unique_ptr<content::WebUIController>
  20. FileManagerUntrustedUIConfig::CreateWebUIController(content::WebUI* web_ui) {
  21. return std::make_unique<FileManagerUntrustedUI>(web_ui);
  22. }
  23. FileManagerUntrustedUI::FileManagerUntrustedUI(content::WebUI* web_ui)
  24. : ui::UntrustedWebUIController(web_ui) {
  25. content::WebUIDataSource* untrusted_source =
  26. content::WebUIDataSource::CreateAndAdd(
  27. web_ui->GetWebContents()->GetBrowserContext(),
  28. kChromeUIFileManagerUntrustedURL);
  29. untrusted_source->AddResourcePaths(base::make_span(
  30. kFileManagerUntrustedResources, kFileManagerUntrustedResourcesSize));
  31. untrusted_source->AddFrameAncestor(GURL(kChromeUIFileManagerURL));
  32. // By default, prevent all network access. Allow framing blob: URLs for
  33. // browsable content.
  34. untrusted_source->OverrideContentSecurityPolicy(
  35. network::mojom::CSPDirectiveName::FrameSrc, "frame-src blob: 'self';");
  36. // Allow <img>, <audio>, <video> to handle blob: and data: URLs.
  37. untrusted_source->OverrideContentSecurityPolicy(
  38. network::mojom::CSPDirectiveName::DefaultSrc,
  39. "default-src blob: data: 'self';");
  40. // Allow inline styling.
  41. untrusted_source->OverrideContentSecurityPolicy(
  42. network::mojom::CSPDirectiveName::StyleSrc,
  43. "style-src 'unsafe-inline' 'self';");
  44. }
  45. FileManagerUntrustedUI::~FileManagerUntrustedUI() = default;
  46. } // namespace file_manager
  47. } // namespace ash