Forward CSP violation reporting from RenderFrameProxy to RenderFrameImpl.

third_party/WebKit/Source/core/dom/RemoteSecurityContext.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/dom/RemoteSecurityContext.h"
 
-#include "core/frame/csp/ContentSecurityPolicy.h"
+#include "core/frame/RemoteFrameClient.h"
+#include "core/frame/csp/RemoteContentSecurityPolicy.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include "wtf/Assertions.h"
 
 namespace blink {
 
-RemoteSecurityContext::RemoteSecurityContext()
+RemoteSecurityContext::RemoteSecurityContext(RemoteFrameClient* remoteFrameClient)
     : SecurityContext()
+    , m_remoteFrameClient(remoteFrameClient)
 {
     // RemoteSecurityContext's origin is expected to stay uninitialized until
     // we set it using replicated origin data from the browser process.
     DCHECK(!getSecurityOrigin());
 
+    // Caller needs to pass a non-null |remoteFrameClient|.
+    DCHECK(remoteFrameClient);
+
     // Start with a clean slate.
-    setContentSecurityPolicy(ContentSecurityPolicy::create());
+    setContentSecurityPolicy(RemoteContentSecurityPolicy::create(m_remoteFrameClient));
 
     // FIXME: Document::initSecurityContext has a few other things we may
     // eventually want here, such as enforcing a setting to
     // grantUniversalAccess().
 }
 
-RemoteSecurityContext* RemoteSecurityContext::create()
+RemoteSecurityContext* RemoteSecurityContext::create(RemoteFrameClient* remoteFrameClient)
 {
-    return new RemoteSecurityContext();
+    return new RemoteSecurityContext(remoteFrameClient);
 }
 
 DEFINE_TRACE(RemoteSecurityContext)
 {
+    visitor->trace(m_remoteFrameClient);
     SecurityContext::trace(visitor);
 }
 
 void RemoteSecurityContext::setReplicatedOrigin(PassRefPtr<SecurityOrigin> origin)
 {
     DCHECK(origin);
     setSecurityOrigin(origin);
     contentSecurityPolicy()->setupSelf(*getSecurityOrigin());
 }
 
 void RemoteSecurityContext::resetReplicatedContentSecurityPolicy()
 {
     DCHECK(getSecurityOrigin());
-    setContentSecurityPolicy(ContentSecurityPolicy::create());
+    setContentSecurityPolicy(RemoteContentSecurityPolicy::create(m_remoteFrameClient));

[alexmos, 2016/08/09 18:01:19]

It's unfortunate that we need to store m_remoteFrameClient here in addition to
remote CSP just for this, but the alternatives I'm thinking about are probably
worse, so this seems fine. :)

[Łukasz Anforowicz, 2016/08/09 22:23:20]

Acknowledged.

     contentSecurityPolicy()->setupSelf(*getSecurityOrigin());
 }
 
 } // namespace blink