[HTML Import] Respect Content Security Policy Model

Source/core/html/HTMLImportsController.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 72 matching lines @@
     }
 
     HTMLImportsController* controller = m_owner->document()->import()->controller();
     if (RefPtr<HTMLImportLoader> found = controller->findLinkFor(builder.url())) {
         m_loader = found;
         return;
     }
 
     CachedResourceRequest request = builder.build(true);
     request.setPotentiallyCrossOriginEnabled(controller->securityOrigin(), DoNotAllowStoredCredentials);
-    CachedResourceHandle<CachedRawResource> resource = controller->cachedResourceLoader()->requestRawResource(request);
+    CachedResourceHandle<CachedRawResource> resource = controller->cachedResourceLoader()->requestImport(request);
     if (!resource)
         return;
 
     m_loader = HTMLImportLoader::create(controller, builder.url(), resource);
 }
 
 void LinkImport::ownerRemoved()
 {
     m_owner = 0;
     m_loader.clear();
@@ skipping 69 matching lines @@
         controller->didLoad(this);
 }
 
 HTMLImportLoader::State HTMLImportLoader::startParsing(const ResourceResponse& response)
 {
     // Current canAccess() implementation isn't sufficient for catching cross-domain redirects: http://crbug.com/256976
     if (!controller()->cachedResourceLoader()->canAccess(m_resource.get()))
         return StateError;
 
     m_importedDocument = HTMLDocument::create(DocumentInit(response.url(), 0, this));
+    m_importedDocument->initContentSecurityPolicy();
     m_writer = DocumentWriter::create(m_importedDocument.get(), response.mimeType(), response.textEncodingName());
 
     return StateLoading;
 }
 
 HTMLImportLoader::State HTMLImportLoader::finish()
 {
     if (!m_parent)
         return StateError;
     // The writer instance indicates that a part of the document can be already loaded.
@@ skipping 129 matching lines @@
 {
     return m_master;
 }
 
 void HTMLImportsController::wasDetachedFromDocument()
 {
     clear();
 }
 
 } // namespace WebCore