Replace frame-src with child-src in WebUI CSP

content/browser/webui/url_data_manager_backend.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/webui/url_data_manager_backend.h"
 
 #include <set>
 
 #include "base/bind.h"
 #include "base/command_line.h"
@@ skipping 140 matching lines @@
   void set_content_security_policy_object_source(
       const std::string& data) {
     content_security_policy_object_source_ = data;
   }
 
   void set_content_security_policy_script_source(
       const std::string& data) {
     content_security_policy_script_source_ = data;
   }
 
-  void set_content_security_policy_frame_source(
+  void set_content_security_policy_child_source(
       const std::string& data) {
-    content_security_policy_frame_source_ = data;
+    content_security_policy_child_source_ = data;
   }
 
   void set_content_security_policy_style_source(
       const std::string& data) {
     content_security_policy_style_source_ = data;
   }
 
   void set_content_security_policy_image_source(
       const std::string& data) {
     content_security_policy_image_source_ = data;
@@ skipping 42 matching lines @@
 
   // If true, set a header in the response to prevent it from being cached.
   bool allow_caching_;
 
   // If true, set the Content Security Policy (CSP) header.
   bool add_content_security_policy_;
 
   // These are used with the CSP.
   std::string content_security_policy_script_source_;
   std::string content_security_policy_object_source_;
-  std::string content_security_policy_frame_source_;
+  std::string content_security_policy_child_source_;
   std::string content_security_policy_style_source_;
   std::string content_security_policy_image_source_;
 
   // If true, sets  the "X-Frame-Options: DENY" header.
   bool deny_xframe_options_;
 
   // If true, sets the "Content-Type: <mime-type>" header.
   bool send_content_type_header_;
 
   // If not empty, "Access-Control-Allow-Origin:" is set to the value of this
@@ skipping 65 matching lines @@
   // indistiguishable from other error types. Instant relies on getting a 200.
   info->headers = new net::HttpResponseHeaders("HTTP/1.1 200 OK");
 
   // Determine the least-privileged content security policy header, if any,
   // that is compatible with a given WebUI URL, and append it to the existing
   // response headers.
   if (add_content_security_policy_) {
     std::string base = kChromeURLContentSecurityPolicyHeaderBase;
     base.append(content_security_policy_script_source_);
     base.append(content_security_policy_object_source_);
-    base.append(content_security_policy_frame_source_);
+    base.append(content_security_policy_child_source_);
     base.append(content_security_policy_style_source_);
     base.append(content_security_policy_image_source_);
     info->headers->AddHeader(base);
   }
 
   if (deny_xframe_options_)
     info->headers->AddHeader(kChromeURLXFrameOptionsHeader);
 
   if (!allow_caching_)
     info->headers->AddHeader("Cache-Control: no-cache");
@@ skipping 265 matching lines @@
   RequestID request_id = next_request_id_++;
   pending_requests_.insert(std::make_pair(request_id, job));
 
   job->set_allow_caching(source->source()->AllowCaching());
   job->set_add_content_security_policy(
       source->source()->ShouldAddContentSecurityPolicy());
   job->set_content_security_policy_script_source(
       source->source()->GetContentSecurityPolicyScriptSrc());
   job->set_content_security_policy_object_source(
       source->source()->GetContentSecurityPolicyObjectSrc());
-  job->set_content_security_policy_frame_source(
-      source->source()->GetContentSecurityPolicyFrameSrc());
+  job->set_content_security_policy_child_source(
+      source->source()->GetContentSecurityPolicyChildSrc());
   job->set_content_security_policy_style_source(
       source->source()->GetContentSecurityPolicyStyleSrc());
   job->set_content_security_policy_image_source(
       source->source()->GetContentSecurityPolicyImgSrc());
   job->set_deny_xframe_options(
       source->source()->ShouldDenyXFrameOptions());
   job->set_send_content_type_header(
       source->source()->ShouldServeMimeTypeAsContentTypeHeader());
 
   std::string origin = GetOriginHeaderValue(request);
@@ skipping 154 matching lines @@
 
 }  // namespace
 
 net::URLRequestJobFactory::ProtocolHandler*
 CreateDevToolsProtocolHandler(content::ResourceContext* resource_context,
                               bool is_incognito) {
   return new DevToolsJobFactory(resource_context, is_incognito);
 }
 
 }  // namespace content