Replicate Content-Security-Policy into remote frame proxies.

third_party/WebKit/Source/core/loader/FrameLoaderClient.h

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
@@ skipping 21 matching lines @@
 
 #include "core/CoreExport.h"
 #include "core/dom/Document.h"
 #include "core/dom/IconURL.h"
 #include "core/fetch/ResourceLoaderOptions.h"
 #include "core/frame/FrameClient.h"
 #include "core/html/LinkResource.h"
 #include "core/loader/FrameLoaderTypes.h"
 #include "core/loader/NavigationPolicy.h"
 #include "platform/heap/Handle.h"
+#include "platform/network/ContentSecurityPolicyParsers.h"
 #include "platform/network/ResourceLoadPriority.h"
 #include "platform/weborigin/Referrer.h"
 #include "public/platform/WebLoadingBehaviorFlag.h"
 #include "wtf/Forward.h"
 #include "wtf/Vector.h"
 #include <v8.h>
 
 namespace blink {
 
 class Document;
@@ skipping 201 matching lines @@
     // Called when elements preventing the sudden termination of the frame
     // become present or stop being present. |type| is the type of element
     // (BeforeUnload handler, Unload handler).
     enum SuddenTerminationDisablerType {
         BeforeUnloadHandler,
         UnloadHandler,
     };
     virtual void suddenTerminationDisablerChanged(bool present, SuddenTerminationDisablerType) { }
 
     virtual LinkResource* createServiceWorkerLinkResource(HTMLLinkElement*) { return nullptr; }
+
+    // Called when a new Content Security Policy is added to the frame's
+    // document.  This can be trigerred by handling of HTTP headers, handling
+    // of <meta> element, or by inheriting CSP from the parent (in case of
+    // about:blank).
+    virtual void didAddContentSecurityPolicy(const String& headerValue, ContentSecurityPolicyHeaderType, ContentSecurityPolicyHeaderSource) { }

[alexmos, 2016/05/11 19:46:41]

nit: maybe move this up to where sandbox flags and origin are updated.

[Łukasz Anforowicz, 2016/05/11 23:14:48]

Done.

 };
 
 } // namespace blink
 
 #endif // FrameLoaderClient_h