Give shared workers their own content security policies

Source/web/WebSharedWorkerImpl.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 86 matching lines @@
         m_finishCallback = finishCallback;
         m_scriptLoader->setRequestContext(WebURLRequest::RequestContextSharedWorker);
         m_scriptLoader->loadAsynchronously(
             *loadingContext, scriptURL, DenyCrossOriginRequests, this);
     }
 
     void didReceiveResponse(unsigned long identifier, const ResourceResponse& response) override
     {
         m_identifier = identifier;
         m_appCacheID = response.appCacheID();
+        processContentSecurityPolicy(response);
         (*m_receiveResponseCallback)();
     }
 
     virtual void notifyFinished() override
     {
         (*m_finishCallback)();
     }
 
     void cancel()
     {
         m_scriptLoader->cancel();
     }
 
     bool failed() const { return m_scriptLoader->failed(); }
     const KURL& url() const { return m_scriptLoader->responseURL(); }
     String script() const { return m_scriptLoader->script(); }
     unsigned long identifier() const { return m_identifier; }
     long long appCacheID() const { return m_appCacheID; }
 
 private:
-    Loader() : m_scriptLoader(WorkerScriptLoader::create()), m_identifier(0), m_appCacheID(0)
+    Loader()
+        : m_scriptLoader(WorkerScriptLoader::create())
+        , m_identifier(0)
+        , m_appCacheID(0)
     {
+        setContentSecurityPolicy(ContentSecurityPolicy::create());
     }
 
     RefPtr<WorkerScriptLoader> m_scriptLoader;
     unsigned long m_identifier;
     long long m_appCacheID;
     OwnPtr<Closure> m_receiveResponseCallback;
     OwnPtr<Closure> m_finishCallback;
 };
 
 // This function is called on the main thread to force to initialize some static
@@ skipping 227 matching lines @@
     port->entangle(channel);
     WorkerGlobalScope* workerGlobalScope = toWorkerGlobalScope(context);
     ASSERT_WITH_SECURITY_IMPLICATION(workerGlobalScope->isSharedWorkerGlobalScope());
     workerGlobalScope->dispatchEvent(createConnectEvent(port.release()));
 }
 
 void WebSharedWorkerImpl::startWorkerContext(const WebURL& url, const WebString& name, const WebString& contentSecurityPolicy, WebContentSecurityPolicyType policyType)
 {
     m_url = url;
     m_name = name;
-    m_contentSecurityPolicy = contentSecurityPolicy;
-    m_policyType = policyType;
     initializeLoader();
 }
 
 void WebSharedWorkerImpl::didReceiveScriptLoaderResponse()
 {
     InspectorInstrumentation::didReceiveScriptResponse(m_loadingDocument.get(), m_mainScriptLoader->identifier());
     if (client())
         client()->selectAppCacheID(m_mainScriptLoader->appCacheID());
 }
 
@@ skipping 19 matching lines @@
     if (InspectorInstrumentation::shouldPauseDedicatedWorkerOnStart(document))
         startMode = PauseWorkerGlobalScopeOnStart;
 
     // FIXME: this document's origin is pristine and without any extra privileges. (crbug.com/254993)
     SecurityOrigin* starterOrigin = document->securityOrigin();
 
     OwnPtrWillBeRawPtr<WorkerClients> workerClients = WorkerClients::create();
     provideLocalFileSystemToWorker(workerClients.get(), LocalFileSystemClient::create());
     WebSecurityOrigin webSecurityOrigin(m_loadingDocument->securityOrigin());
     provideContentSettingsClientToWorker(workerClients.get(), adoptPtr(client()->createWorkerContentSettingsClientProxy(webSecurityOrigin)));
-    OwnPtr<WorkerThreadStartupData> startupData = WorkerThreadStartupData::create(m_url, m_loadingDocument->userAgent(m_url), m_mainScriptLoader->script(), nullptr, startMode, m_contentSecurityPolicy, static_cast<ContentSecurityPolicyHeaderType>(m_policyType), starterOrigin, workerClients.release());
+    OwnPtr<WorkerThreadStartupData> startupData = WorkerThreadStartupData::create(m_url, m_loadingDocument->userAgent(m_url), m_mainScriptLoader->script(), nullptr, startMode, m_mainScriptLoader->contentSecurityPolicy()->deprecatedHeader(), static_cast<ContentSecurityPolicyHeaderType>(m_mainScriptLoader->contentSecurityPolicy()->deprecatedHeaderType()), starterOrigin, workerClients.release());
     m_loaderProxy = WorkerLoaderProxy::create(this);
     setWorkerThread(SharedWorkerThread::create(m_name, m_loaderProxy, *this, startupData.release()));
     InspectorInstrumentation::scriptImported(m_loadingDocument.get(), m_mainScriptLoader->identifier(), m_mainScriptLoader->script());
     m_mainScriptLoader.clear();
 
     workerThread()->start();
     m_workerInspectorProxy->workerThreadCreated(m_loadingDocument.get(), workerThread(), m_url);
     if (client())
         client()->workerScriptLoaded();
 }
@@ skipping 43 matching lines @@
     if (devtoolsAgent)
         devtoolsAgent->dispatchOnInspectorBackend(message);
 }
 
 WebSharedWorker* WebSharedWorker::create(WebSharedWorkerClient* client)
 {
     return new WebSharedWorkerImpl(client);
 }
 
 } // namespace blink