Repository: shapesecurity/salvation
Pull request #174 (2017-01-17 20:15:06)

Warn about deprecation of referrer directive.
fixes GH-173


Patch:
diff --git a/src/main/java/com/shapesecurity/salvation/Parser.java b/src/main/java/com/shapesecurity/salvation/Parser.java
index 4e4e324..16a18c8 100644
--- a/src/main/java/com/shapesecurity/salvation/Parser.java
+++ b/src/main/java/com/shapesecurity/salvation/Parser.java
@@ -253,7 +253,8 @@ public class Parser {
                     result = new PluginTypesDirective(mediaTypes);
                     break;
                 case Referrer:
-                    warnFutureDirective(token);
+                    this.warn(token,
+                            "The referrer directive was an experimental directive that was proposed but never added to the CSP specification. Support for this directive will be removed. See Referrer Policy specification.");
                     result = new ReferrerDirective(this.parseReferrerToken(token));
                     break;
                 case ReportTo:
diff --git a/src/main/java/com/shapesecurity/salvation/tokens/DirectiveNameToken.java b/src/main/java/com/shapesecurity/salvation/tokens/DirectiveNameToken.java
index 391944b..7e0d28c 100644
--- a/src/main/java/com/shapesecurity/salvation/tokens/DirectiveNameToken.java
+++ b/src/main/java/com/shapesecurity/salvation/tokens/DirectiveNameToken.java
@@ -31,7 +31,7 @@ public class DirectiveNameToken extends Token {
         MediaSrc,
         ObjectSrc,
         PluginTypes,
-        Referrer, // in draft at http://www.w3.org/TR/2014/WD-referrer-policy-20140807/#referrer-policy-delivery as of 2015-08-27
+        Referrer, // will be removed
         ReportTo, // CSP3; in draft at http://w3c.github.io/webappsec-csp/#directive-report-to
         ReportUri, // CSP3 deprecates it
         RequireSriFor, // defined in https://w3c.github.io/webappsec-subresource-integrity/#opt-in-require-sri-for


Test patch:
diff --git a/src/test/java/com/shapesecurity/salvation/LocationTest.java b/src/test/java/com/shapesecurity/salvation/LocationTest.java
index 9122cc0..cfa76f1 100644
--- a/src/test/java/com/shapesecurity/salvation/LocationTest.java
+++ b/src/test/java/com/shapesecurity/salvation/LocationTest.java
@@ -224,7 +224,7 @@ public class LocationTest extends CSPTest {
         assertEquals(1, notices.get(0).endLocation.line);
         assertEquals(9, notices.get(0).endLocation.column);
         assertEquals(8, notices.get(0).endLocation.offset);
-        assertEquals("Warning: The referrer directive is an experimental directive that will be likely added to the CSP specification.", notices.get(0).toString());
+        assertEquals("Warning: The referrer directive was an experimental directive that was proposed but never added to the CSP specification. Support for this directive will be removed. See Referrer Policy specification.", notices.get(0).toString());
         assertNotNull(notices.get(1).startLocation);
         assertEquals(1, notices.get(1).startLocation.line);
         assertEquals(1, notices.get(1).startLocation.column);
@@ -255,7 +255,7 @@ public class LocationTest extends CSPTest {
         assertEquals(1, notices.get(0).endLocation.line);
         assertEquals(9, notices.get(0).endLocation.column);
         assertEquals(8, notices.get(0).endLocation.offset);
-        assertEquals("The referrer directive is an experimental directive that will be likely added to the CSP specification.", notices.get(0).message);
+        assertEquals("The referrer directive was an experimental directive that was proposed but never added to the CSP specification. Support for this directive will be removed. See Referrer Policy specification.", notices.get(0).message);
         assertNotNull(notices.get(1).startLocation);
         assertEquals(1, notices.get(1).startLocation.line);
         assertEquals(22, notices.get(1).startLocation.column);
diff --git a/src/test/java/com/shapesecurity/salvation/ParserTest.java b/src/test/java/com/shapesecurity/salvation/ParserTest.java
index 77fbb52..817545c 100644
--- a/src/test/java/com/shapesecurity/salvation/ParserTest.java
+++ b/src/test/java/com/shapesecurity/salvation/ParserTest.java
@@ -715,7 +715,7 @@ public class ParserTest extends CSPTest {
         p = parseWithNotices("referrer", notices);
         assertEquals(0, p.getDirectives().size());
         assertEquals(2, notices.size());
-        assertEquals("The referrer directive is an experimental directive that will be likely added to the CSP specification.", notices.get(0).message);
+        assertEquals("The referrer directive was an experimental directive that was proposed but never added to the CSP specification. Support for this directive will be removed. See Referrer Policy specification.", notices.get(0).message);
         assertEquals("The referrer directive must contain exactly one referrer directive value.", notices.get(1).message);
 
         notices.clear();
@@ -957,7 +957,7 @@ public class ParserTest extends CSPTest {
         assertEquals(3, notices.size());
         assertEquals("1:1: The allow directive has been replaced with default-src and is not in the CSP specification.",
             notices.get(0).show());
-        assertEquals("1:15: The referrer directive is an experimental directive that will be likely added to the CSP specification.", notices.get(1).show());
+        assertEquals("1:15: The referrer directive was an experimental directive that was proposed but never added to the CSP specification. Support for this directive will be removed. See Referrer Policy specification.", notices.get(1).show());
         assertEquals("1:15: The referrer directive must contain exactly one referrer directive value.", notices.get(2).show());
 
         notices.clear();