Change uses of base::JoinString to pass StringPieces where possible.

extensions/common/csp_validator.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/common/csp_validator.h"
 
 #include <stddef.h>
 
 #include <initializer_list>
 #include <vector>
 
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/macros.h"
+#include "base/strings/string_piece.h"
 #include "base/strings/string_split.h"
 #include "base/strings/string_tokenizer.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "content/public/common/url_constants.h"
 #include "extensions/common/constants.h"
 #include "extensions/common/error_utils.h"
 #include "extensions/common/install_warning.h"
 #include "extensions/common/manifest_constants.h"
 #include "net/base/registry_controlled_domains/registry_controlled_domain.h"
@@ skipping 165 matching lines @@
 
 InstallWarning CSPInstallWarning(const std::string& csp_warning) {
   return InstallWarning(csp_warning, manifest_keys::kContentSecurityPolicy);
 }
 
 std::string GetSecureDirectiveValues(
     int options,
     const std::string& directive_name,
     const std::vector<base::StringPiece>& directive_values,
     std::vector<InstallWarning>* warnings) {
-  std::vector<std::string> sane_csp_parts(1, directive_name);
+  std::vector<base::StringPiece> sane_csp_parts{directive_name};
   for (base::StringPiece source_literal : directive_values) {
     std::string source_lower = base::ToLowerASCII(source_literal);
     bool is_secure_csp_token = false;
 
     // We might need to relax this whitelist over time.
     if (source_lower == "'self'" || source_lower == "'none'" ||
         source_lower == "http://127.0.0.1" || source_lower == "blob:" ||
         source_lower == "filesystem:" || source_lower == "http://localhost" ||
         base::StartsWith(source_lower, "http://127.0.0.1:",
                          base::CompareCase::SENSITIVE) ||
@@ skipping 13 matching lines @@
     } else if (base::StartsWith(source_lower, "chrome-extension-resource:",
                                 base::CompareCase::SENSITIVE)) {
       // The "chrome-extension-resource" scheme has been removed from the
       // codebase, but it may still appear in existing CSPs. We continue to
       // allow it here for compatibility. Requests on this scheme will not
       // return any kind of network response.
       is_secure_csp_token = true;
     }
 
     if (is_secure_csp_token) {
-      sane_csp_parts.push_back(source_literal.as_string());
+      sane_csp_parts.push_back(source_literal);
     } else if (warnings) {
       warnings->push_back(CSPInstallWarning(ErrorUtils::FormatErrorMessage(
           manifest_errors::kInvalidCSPInsecureValue, source_literal.as_string(),
           directive_name)));
     }
   }
   // End of CSP directive that was started at the beginning of this method. If
   // none of the values are secure, the policy will be empty and default to
   // 'none', which is secure.
-  sane_csp_parts.back().push_back(kDirectiveSeparator);
+  std::string last_part = sane_csp_parts.back().as_string();
+  last_part.push_back(kDirectiveSeparator);
+  sane_csp_parts.back() = last_part;
   return base::JoinString(sane_csp_parts, " ");
 }
 
 // Given a CSP directive-token for app sandbox, returns a secure value of that
 // directive.
 // The directive-token's name is |directive_name| and its values are splitted
 // into |directive_values|.
 std::string GetAppSandboxSecureDirectiveValues(
     const std::string& directive_name,
     const std::vector<base::StringPiece>& directive_values,
     std::vector<InstallWarning>* warnings) {
-  std::vector<std::string> sane_csp_parts(1, directive_name);
+  std::vector<std::string> sane_csp_parts{directive_name};
   bool seen_self_or_none = false;
   for (base::StringPiece source_literal : directive_values) {
     std::string source_lower = base::ToLowerASCII(source_literal);
 
     // Keyword directive sources are surrounded with quotes, e.g. 'self',
     // 'sha256-...', 'unsafe-eval', 'nonce-...'. These do not specify a remote
     // host or '*', so keep them and restrict the rest.
     if (source_lower.size() > 1u && source_lower[0] == '\'' &&
         source_lower.back() == '\'') {
       seen_self_or_none |= source_lower == "'none'" || source_lower == "'self'";
@@ skipping 319 matching lines @@
       }
     }
   }
 
   return seen_sandbox;
 }
 
 }  // namespace csp_validator
 
 }  // namespace extensions