Use RequestContext to apply CSP in FrameFetchContext

third_party/WebKit/Source/core/loader/DocumentThreadableLoader.h

 /*
  * Copyright (C) 2009, 2012 Google Inc. All rights reserved.
  * Copyright (C) 2013, Intel Corporation
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 17 matching lines @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef DocumentThreadableLoader_h
 #define DocumentThreadableLoader_h
 
 #include "core/CoreExport.h"
 #include "core/fetch/RawResource.h"
 #include "core/fetch/ResourceOwner.h"
-#include "core/frame/csp/ContentSecurityPolicy.h"
 #include "core/loader/ThreadableLoader.h"
 #include "platform/Timer.h"
 #include "platform/heap/Handle.h"
 #include "platform/network/HTTPHeaderMap.h"
 #include "platform/network/ResourceError.h"
 #include "wtf/Forward.h"
 #include "wtf/OwnPtr.h"
 #include "wtf/PassOwnPtr.h"
 #include "wtf/WeakPtr.h"
 #include "wtf/text/WTFString.h"
@@ skipping 20 matching lines @@
         // |this| may be dead after calling this method in async mode.
         void cancel() override;
         void setDefersLoading(bool);
 
     private:
         enum BlockingBehavior {
             LoadSynchronously,
             LoadAsynchronously
         };
 
-        enum EnforceContentSecurityPolicyDirective {
-            EnforceWorkerDirective,
-            EnforceConnectSrcDirective,
-            EnforceManifestSrcDirective,
-            EnforceMediaSrcDirective,
-        };
-
         DocumentThreadableLoader(Document&, ThreadableLoaderClient*, BlockingBehavior, const ThreadableLoaderOptions&, const ResourceLoaderOptions&);
 
         void clear();
 
         // ResourceClient
         //
         // |this| may be dead after calling this method.
         void notifyFinished(Resource*) override;
 
         String debugName() const override { return "DocumentThreadableLoader"; }
 
         // RawResourceClient
         //
         // |this| may be dead after calling these methods.
         void dataSent(Resource*, unsigned long long bytesSent, unsigned long long totalBytesToBeSent) override;
         void responseReceived(Resource*, const ResourceResponse&, PassOwnPtr<WebDataConsumerHandle>) override;
         void setSerializedCachedMetadata(Resource*, const char*, size_t) override;
         void dataReceived(Resource*, const char* data, size_t dataLength) override;
         void redirectReceived(Resource*, ResourceRequest&, const ResourceResponse&) override;
+        void redirectBlocked() override;
         void dataDownloaded(Resource*, int) override;
         void didReceiveResourceTiming(Resource*, const ResourceTimingInfo&) override;
 
         // |this| may be dead after calling this method in async mode.
         void cancelWithError(const ResourceError&);
 
         // Notify Inspector and log to console about resource response. Use
         // this method if response is not going to be finished normally.
         void reportResponseReceived(unsigned long identifier, const ResourceResponse&);
 
@@ skipping 29 matching lines @@
         // Investigates the response for the preflight request. If successful,
         // the actual request will be made later in handleSuccessfulFinish().
         //
         // |this| may be dead after calling this method in async mode.
         void handlePreflightResponse(const ResourceResponse&);
         // |this| may be dead after calling this method.
         void handleError(const ResourceError&);
 
         void loadRequest(const ResourceRequest&, ResourceLoaderOptions);
         bool isAllowedRedirect(const KURL&) const;
-        bool isAllowedByContentSecurityPolicy(const KURL&, ContentSecurityPolicy::RedirectStatus) const;
         // Returns DoNotAllowStoredCredentials
         // if m_forceDoNotAllowStoredCredentials is set. Otherwise, just
         // returns allowCredentials value of m_resourceLoaderOptions.
         StoredCredentials effectiveAllowCredentials() const;
 
         // TODO(oilpan): DocumentThreadableLoader used to be a ResourceOwner,
         // but ResourceOwner was moved onto the oilpan heap before
         // DocumentThreadableLoader was ready. When DocumentThreadableLoader
         // moves onto the oilpan heap, make it a ResourceOwner again and remove
         // this re-implementation of ResourceOwner.
@@ skipping 36 matching lines @@
         bool m_sameOriginRequest;
         // Set to true if the current request is cross-origin and not simple.
         bool m_crossOriginNonSimpleRequest;
 
         // Set to true when the response data is given to a data consumer
         // handle.
         bool m_isUsingDataConsumerHandle;
 
         const bool m_async;
 
-        // Holds the original request context (used for sanity checks and Content Security Policy enforcement).
+        // Holds the original request context (used for sanity checks).
         WebURLRequest::RequestContext m_requestContext;
 
         // Holds the original request for fallback in case the Service Worker
         // does not respond.
         ResourceRequest m_fallbackRequestForServiceWorker;
 
         // Holds the original request and options for it during preflight
         // request handling phase.
         ResourceRequest m_actualRequest;
         ResourceLoaderOptions m_actualOptions;
@@ skipping 10 matching lines @@
         int m_corsRedirectLimit;
 
         WebURLRequest::FetchRedirectMode m_redirectMode;
 
         WeakPtrFactory<DocumentThreadableLoader> m_weakFactory;
     };
 
 } // namespace blink
 
 #endif // DocumentThreadableLoader_h