Replicate Content-Security-Policy into remote frame proxies.

content/renderer/render_frame_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_impl.h"
 
 #include <map>
 #include <string>
 #include <utility>
 #include <vector>
@@ skipping 32 matching lines @@
 #include "content/child/service_worker/service_worker_provider_context.h"
 #include "content/child/service_worker/web_service_worker_provider_impl.h"
 #include "content/child/v8_value_converter_impl.h"
 #include "content/child/web_url_loader_impl.h"
 #include "content/child/web_url_request_util.h"
 #include "content/child/webmessageportchannel_impl.h"
 #include "content/child/websocket_bridge.h"
 #include "content/child/weburlresponse_extradata_impl.h"
 #include "content/common/accessibility_messages.h"
 #include "content/common/clipboard_messages.h"
+#include "content/common/content_security_policy_header.h"
 #include "content/common/frame_messages.h"
 #include "content/common/frame_replication_state.h"
 #include "content/common/gpu/client/context_provider_command_buffer.h"
 #include "content/common/input_messages.h"
 #include "content/common/navigation_params.h"
 #include "content/common/page_messages.h"
 #include "content/common/savable_subframe.h"
 #include "content/common/service_worker/service_worker_types.h"
 #include "content/common/site_isolation_policy.h"
 #include "content/common/ssl_status_serialization.h"
@@ skipping 5944 matching lines @@
       media::ConvertToOutputDeviceStatusCB(web_callbacks);
   callback.Run(AudioDeviceFactory::GetOutputDeviceInfo(
                    routing_id_, 0, sink_id.utf8(), security_origin)
                    .device_status());
 }
 
 blink::ServiceRegistry* RenderFrameImpl::serviceRegistry() {
   return &blink_service_registry_;
 }
 
+void RenderFrameImpl::didAddContentSecurityPolicy(
+    const blink::WebString& header_value,
+    blink::WebContentSecurityPolicyType type,
+    blink::WebContentSecurityPolicySource source) {
+  if (!SiteIsolationPolicy::AreCrossProcessFramesPossible())

[alexmos, 2016/05/12 22:37:24]

I think this is ok.  One thought is that this might be needed when we start
enforcing CSP from the browser process even when site isolation is off, but I
guess we can revisit this then and not incur unnecessary overhead in the
meantime.

[Łukasz Anforowicz, 2016/05/13 17:29:15]

This reminds me - there are other places where we avoid sending extra IPC
messages when OOPIFs are disabled (most notably FrameHostMsg_DidChangeName). 
I'll mention bug https://crbug.com/169110 on chat.

+    return;
+
+  ContentSecurityPolicyHeader header;
+  header.header_value = base::UTF16ToUTF8(base::StringPiece16(header_value));
+  header.type = type;
+  header.source = source;
+  Send(new FrameHostMsg_DidAddContentSecurityPolicy(routing_id_, header));
+}
+
 blink::WebPlugin* RenderFrameImpl::GetWebPluginForFind() {
   if (!is_main_frame_)
     return nullptr;
 
   if (frame_->document().isPluginDocument())
     return frame_->document().to<WebPluginDocument>().plugin();
 
 #if defined(ENABLE_PLUGINS)
   if (plugin_find_handler_)
     return plugin_find_handler_->container()->plugin();
 #endif
 
   return nullptr;
 }
 
 void RenderFrameImpl::SendFindReply(int request_id,
                                     int match_count,
                                     int ordinal,
                                     const WebRect& selection_rect,
                                     bool final_status_update) {
   Send(new FrameHostMsg_Find_Reply(routing_id_, request_id, match_count,
                                    selection_rect, ordinal,
                                    final_status_update));
 }
 
 }  // namespace content