Replicate Content-Security-Policy into remote frame proxies.

third_party/WebKit/Source/core/loader/FrameLoaderClient.h

Index: third_party/WebKit/Source/core/loader/FrameLoaderClient.h
diff --git a/third_party/WebKit/Source/core/loader/FrameLoaderClient.h b/third_party/WebKit/Source/core/loader/FrameLoaderClient.h
index 131c5210b59d56cf369591616fc1c311a0dde429..204910717db57ecbe466a71ae24e14ec52b3747c 100644
--- a/third_party/WebKit/Source/core/loader/FrameLoaderClient.h
+++ b/third_party/WebKit/Source/core/loader/FrameLoaderClient.h
@@ -39,6 +39,7 @@
 #include "core/loader/FrameLoaderTypes.h"
 #include "core/loader/NavigationPolicy.h"
 #include "platform/heap/Handle.h"
+#include "platform/network/ContentSecurityPolicyParsers.h"
 #include "platform/network/ResourceLoadPriority.h"
 #include "platform/weborigin/Referrer.h"
 #include "public/platform/WebLoadingBehaviorFlag.h"
@@ -260,6 +261,12 @@ public:
     virtual void suddenTerminationDisablerChanged(bool present, SuddenTerminationDisablerType) { }
 
     virtual LinkResource* createServiceWorkerLinkResource(HTMLLinkElement*) { return nullptr; }
+
+    // Called when a new Content Security Policy is added to the frame's
+    // document.  This can be trigerred by handling of HTTP headers, handling
+    // of <meta> element, or by inheriting CSP from the parent (in case of
+    // about:blank).
+    virtual void didAddContentSecurityPolicy(const String& headerValue, ContentSecurityPolicyHeaderType, ContentSecurityPolicyHeaderSource) { }

[alexmos, 2016/05/11 19:46:41]

nit: maybe move this up to where sandbox flags and origin are updated.

[Łukasz Anforowicz, 2016/05/11 23:14:48]

Done.

 };
 
 } // namespace blink