[HTML Import] Respect Content Security Policy Model

Source/core/page/ContentSecurityPolicy.cpp

 /*
  * Copyright (C) 2011 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 1403 matching lines @@
 }
 
 ContentSecurityPolicy::~ContentSecurityPolicy()
 {
 }
 
 void ContentSecurityPolicy::copyStateFrom(const ContentSecurityPolicy* other)
 {
     ASSERT(m_policies.isEmpty());
     for (CSPDirectiveListVector::const_iterator iter = other->m_policies.begin(); iter != other->m_policies.end(); ++iter)
-        didReceiveHeader((*iter)->header(), (*iter)->headerType());
+        addPolicyFromHeaderValue((*iter)->header(), (*iter)->headerType());
 }
 
 void ContentSecurityPolicy::didReceiveHeader(const String& header, HeaderType type)
 {
+    // ContentSecurityPolicy should be mutable only it has a browsing context. It should be immutable
+    // for Documents made by XHR or HTML Imports.
+    ASSERT(!m_scriptExecutionContext->isDocument() || toDocument(m_scriptExecutionContext)->frame());
+    addPolicyFromHeaderValue(header, type);
+}
+
+void ContentSecurityPolicy::addPolicyFromHeaderValue(const String& header, HeaderType type)
+{
     if (m_scriptExecutionContext->isDocument()) {
         Document* document = toDocument(m_scriptExecutionContext);
         if (type == PrefixedReport || type == PrefixedEnforce)
             UseCounter::countDeprecation(document, getUseCounterType(type));
         else
             UseCounter::count(document, getUseCounterType(type));
     }
 
     Vector<UChar> characters;
     header.appendTo(characters);
@@ skipping 433 matching lines @@
 {
     if (context && context->isDocument()) {
         Document* document = toDocument(context);
         if (document->frame())
             return document->frame()->script()->shouldBypassMainWorldContentSecurityPolicy();
     }
     return false;
 }
 
 }