[HTML Import] Respect Content Security Policy Model

Source/core/html/HTMLImportsController.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 20 matching lines @@
 #include "config.h"
 #include "core/html/HTMLImportsController.h"
 
 #include "core/dom/Document.h"
 #include "core/html/HTMLDocument.h"
 #include "core/html/HTMLLinkElement.h"
 #include "core/loader/CrossOriginAccessControl.h"
 #include "core/loader/DocumentWriter.h"
 #include "core/loader/cache/CachedScript.h"
 #include "core/loader/cache/ResourceFetcher.h"
+#include "core/page/ContentSecurityPolicy.h"
 #include "weborigin/SecurityOrigin.h"
 
 namespace WebCore {
 
 PassRefPtr<LinkImport> LinkImport::create(HTMLLinkElement* owner)
 {
     return adoptRef(new LinkImport(owner));
 }
 
 LinkImport::LinkImport(HTMLLinkElement* owner)
@@ skipping 32 matching lines @@
     }
 
     HTMLImportsController* controller = m_owner->document()->import()->controller();
     if (RefPtr<HTMLImportLoader> found = controller->findLinkFor(builder.url())) {
         m_loader = found;
         return;
     }
 
     FetchRequest request = builder.build(true);
     request.setPotentiallyCrossOriginEnabled(controller->securityOrigin(), DoNotAllowStoredCredentials);
-    CachedResourceHandle<CachedRawResource> resource = controller->fetcher()->requestRawResource(request);
+    CachedResourceHandle<CachedRawResource> resource = m_owner->document()->fetcher()->requestImport(request);

[abarth-chromium, 2013/07/25 04:53:09]

requestImport  ->  fetchImport ?  :)

Not worth renaming in this CL, but an idea for your loader renaming project.

     if (!resource)
         return;
 
     m_loader = HTMLImportLoader::create(controller, builder.url(), resource);
 }
 
 void LinkImport::ownerRemoved()
 {
     m_owner = 0;
     m_loader.clear();
@@ skipping 69 matching lines @@
         controller->didLoad(this);
 }
 
 HTMLImportLoader::State HTMLImportLoader::startParsing(const ResourceResponse& response)
 {
     // Current canAccess() implementation isn't sufficient for catching cross-domain redirects: http://crbug.com/256976
     if (!controller()->fetcher()->canAccess(m_resource.get()))
         return StateError;
 
     m_importedDocument = HTMLDocument::create(DocumentInit(response.url(), 0, this));
+    m_importedDocument->initContentSecurityPolicy(ContentSecurityPolicyResponseHeaders(response));
     m_writer = DocumentWriter::create(m_importedDocument.get(), response.mimeType(), response.textEncodingName());
 
     return StateLoading;
 }
 
 HTMLImportLoader::State HTMLImportLoader::finish()
 {
     if (!m_parent)
         return StateError;
     // The writer instance indicates that a part of the document can be already loaded.
@@ skipping 129 matching lines @@
 {
     return m_master;
 }
 
 void HTMLImportsController::wasDetachedFromDocument()
 {
     clear();
 }
 
 } // namespace WebCore