Move 'frame-src' CSP checks into FrameFetchContext.

third_party/WebKit/Source/core/loader/DocumentLoader.cpp

Index: third_party/WebKit/Source/core/loader/DocumentLoader.cpp
diff --git a/third_party/WebKit/Source/core/loader/DocumentLoader.cpp b/third_party/WebKit/Source/core/loader/DocumentLoader.cpp
index 2a76e14272ea498a29abb8fc6931284c241d6a05..f72d9d59e008024cd376e1b684315e0a399b26b6 100644
--- a/third_party/WebKit/Source/core/loader/DocumentLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/DocumentLoader.cpp
@@ -308,7 +308,7 @@ void DocumentLoader::redirectReceived(Resource* resource, ResourceRequest& reque
         m_fetcher->stopFetching();
         return;
     }
-    if (!frameLoader()->shouldContinueForNavigationPolicy(m_request, SubstituteData(), this, CheckContentSecurityPolicy, m_navigationType, NavigationPolicyCurrentTab, replacesCurrentHistoryItem(), isClientRedirect())) {
+    if (!frameLoader()->shouldContinueForNavigationPolicy(m_request, SubstituteData(), this, m_navigationType, NavigationPolicyCurrentTab, replacesCurrentHistoryItem(), isClientRedirect())) {
         m_fetcher->stopFetching();
         return;
     }
@@ -608,7 +608,14 @@ bool DocumentLoader::maybeLoadEmpty()
     return true;
 }
 
-void DocumentLoader::startLoadingMainResource()
+void DocumentLoader::loadUnique()
+{
+    m_request = ResourceRequest(SecurityOrigin::urlWithUniqueSecurityOrigin());
+    m_response = ResourceResponse(m_request.url(), "text/html", 0, nullAtom, String());
+    finishedLoading(monotonicallyIncreasingTime());
+}
+
+void DocumentLoader::startLoadingMainResource(ContentSecurityPolicyDisposition cspDisposition)
 {
     timing().markNavigationStart();
     ASSERT(!m_mainResource);
@@ -625,10 +632,11 @@ void DocumentLoader::startLoadingMainResource()
     DEFINE_STATIC_LOCAL(ResourceLoaderOptions, mainResourceLoadOptions,
         (DoNotBufferData, AllowStoredCredentials, ClientRequestedCredentials, CheckContentSecurityPolicy, DocumentContext));
     FetchRequest fetchRequest(m_request, FetchInitiatorTypeNames::document, mainResourceLoadOptions);
+    fetchRequest.setContentSecurityCheck(cspDisposition);
+
     m_mainResource = RawResource::fetchMainResource(fetchRequest, fetcher(), m_substituteData);
     if (!m_mainResource) {
-        m_request = ResourceRequest(blankURL());
-        maybeLoadEmpty();
+        loadUnique();

[Yoav Weiss, 2016/06/02 14:13:37]

What's the reason for this change?

[Mike West, 2016/06/02 14:25:45]

Blocking the response ought to leave us with a document that appears
cross-origin to its embedder. We do this in the status quo by calling
`m_frame->document()->enforceSandboxFlags(SandboxOrigin)` in
`FrameLoader::shouldContinueForNavigationPolicy`. Since we're now actually
committing a navigation when a page is blocked, enforcing sandbox flags in
FrameFetchContext wouldn't be effective (as there's no Document yet). The
original patch forced sandboxing flags onto the FrameLoader, but alexmos@
correctly noted that that was a terrible idea.

This approach changes DocumentLoader to commit a navigation to a URL we'll treat
as unique. This is the same thing we do for the XSS auditor and XFO, so this
just aligns blockage in general with that mechanism.

[Yoav Weiss, 2016/06/02 14:28:07]

OK, cool!

[alexmos, 2016/06/02 22:21:07]

Probably not for this CL, but I'm curious if we should also use loadUnique() in
cancelLoadAfterXFrameOptionsOrCSPDenied().  It probably doesn't matter much
though, since you're moving that to the browser process.

[Mike West, 2016/06/06 08:40:10]

Makes sense. I'll reevaluate that once we re-land XFO in the browser.

         return;
     }
     // A bunch of headers are set when the underlying ResourceLoader is created, and m_request needs to include those.