- if (data_->GetPackageType() != Manifest::TYPE_WGT)
- return;
-
- const WARPInfo* info = static_cast<WARPInfo*>(
- data_->GetManifestData(widget_keys::kAccessKey));
- // FIXME(xinchao): Need to enable WARP mode by default.
- if (!info)
- return;
-
- const base::ListValue* whitelist = info->GetWARP();
- for (base::ListValue::const_iterator it = whitelist->begin();
- it != whitelist->end(); ++it) {
- base::DictionaryValue* value = NULL;
- (*it)->GetAsDictionary(&value);
- std::string dest;
- if (!value || !value->GetString(widget_keys::kAccessOriginKey, &dest) ||
- dest.empty())
- continue;
- if (dest == "*") {
- security_mode_enabled_ = false;
- break;
- }
-
- GURL dest_url(dest);
- // The default subdomains attrubute should be "false".
- std::string subdomains = "false";
- value->GetString(widget_keys::kAccessSubdomainsKey, &subdomains);
- AddSecurityPolicy(dest_url, (subdomains == "true"));
- security_mode_enabled_ = true;
- }
- if (security_mode_enabled_) {
- DCHECK(render_process_host_);
- render_process_host_->Send(
- new ViewMsg_EnableSecurityMode(
- ApplicationData::GetBaseURLFromApplicationId(id()),
- SecurityPolicy::WARP));
- }
-}
-
-void Application::AddSecurityPolicy(const GURL& url, bool subdomains) {
- GURL app_url = data_->URL();
- DCHECK(render_process_host_);
- render_process_host_->Send(
- new ViewMsg_SetAccessWhiteList(
- app_url, url, subdomains));
- security_policy_.push_back(new SecurityPolicy(url, subdomains));
+ // CSP policy takes precedence over WARP.
+ if (data_->HasCSPDefined())
+ security_policy_.reset(new ApplicationSecurityPolicyCSP(this));
+ else if (data_->manifest_type() == Manifest::TYPE_WIDGET)
+ security_policy_.reset(new ApplicationSecurityPolicyWARP(this));
+
+ if (security_policy_)
+ security_policy_->Enforce();