[HTML Import] Respect Content Security Policy Model

Source/core/dom/Document.cpp

Index: Source/core/dom/Document.cpp
diff --git a/Source/core/dom/Document.cpp b/Source/core/dom/Document.cpp
index ad49fd17acff8856e429cef6b3965816e5469a35..3e43417d7d8bc0f644c487cd5b454decf723a055 100644
--- a/Source/core/dom/Document.cpp
+++ b/Source/core/dom/Document.cpp
@@ -2637,6 +2637,9 @@ void Document::processHttpEquiv(const String& equiv, const String& content)
 
 void Document::processHttpEquivContentSecurityPolicy(const String& equiv, const String& content)
 {
+    if (!this->frame())
+        return;
+
     if (equalIgnoringCase(equiv, "content-security-policy"))
         contentSecurityPolicy()->didReceiveHeader(content, ContentSecurityPolicy::Enforce);
     else if (equalIgnoringCase(equiv, "content-security-policy-report-only"))
@@ -4207,7 +4210,7 @@ void Document::initSecurityContext(const DocumentInit& initializer)
         return;
     }
 
-    if (!initializer.frame()) {
+    if (!initializer.hasSecurityContext()) {
         // No source for a security context.
         // This can occur via document.implementation.createDocument().

[abarth-chromium, 2013/07/24 18:39:19]

Does this occur for HTML import too?  If so, it would be good to explain that in
the comment.

         m_cookieURL = KURL(ParsedURLString, emptyString());
@@ -4281,10 +4284,10 @@ void Document::initSecurityContext(const DocumentInit& initializer)
 
 void Document::initContentSecurityPolicy()
 {
-    if (!m_frame->tree()->parent() || (!shouldInheritSecurityOriginFromOwner(m_url) && !isPluginDocument()))
-        return;
-
-    contentSecurityPolicy()->copyStateFrom(m_frame->tree()->parent()->document()->contentSecurityPolicy());
+    if (m_frame && m_frame->tree()->parent() && (shouldInheritSecurityOriginFromOwner(m_url) || isPluginDocument()))
+        contentSecurityPolicy()->copyStateFrom(m_frame->tree()->parent()->document()->contentSecurityPolicy());
+    if (HTMLImport* import = this->import())
+        contentSecurityPolicy()->copyStateFrom(import->master()->contentSecurityPolicy());

[abarth-chromium, 2013/07/24 18:39:19]

This looks great.  My only question is about this line of code.  Rather than
taking the CSP from the master document, we're probably better off if we take
the CSP from the Content-Security-Policy header that came with the imported
Document.

Consider: Most people who use CSP will disable inline script (because that's how
you get the XSS protection).  Even if you disable inline script in your main
document, there might not be a security risk in using inline script the HTML you
import.

I'm going to say LGTM to unblock you, but please change the CL so that the
imported document gets its CSP from its own HTTP headers rather than copying it
from the master document.

 }
 
 void Document::didUpdateSecurityOrigin()