Adding Embedding-CSP HTTP header

third_party/WebKit/Source/core/html/HTMLFrameOwnerElement.cpp

 /*
  * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 16 matching lines @@
 #include "core/events/Event.h"
 #include "core/frame/FrameHost.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/layout/LayoutPart.h"
 #include "core/layout/api/LayoutPartItem.h"
 #include "core/loader/FrameLoadRequest.h"
 #include "core/loader/FrameLoader.h"
 #include "core/loader/FrameLoaderClient.h"
 #include "core/plugins/PluginView.h"
+#include "platform/RuntimeEnabledFeatures.h"
 #include "platform/weborigin/SecurityOrigin.h"
 
 namespace blink {
 
 typedef HeapHashMap<Member<Widget>, Member<FrameView>> WidgetToParentMap;
 static WidgetToParentMap& widgetNewParentMap()
 {
     DEFINE_STATIC_LOCAL(WidgetToParentMap, map, (new WidgetToParentMap));
     return map;
 }
@@ skipping 274 matching lines @@
 
     if (document().frame()->host()->subframeCount() >= FrameHost::maxNumberOfFrames)
         return false;
 
     FrameLoadRequest frameLoadRequest(&document(), url, "_self", CheckContentSecurityPolicy);
 
     ReferrerPolicy policy = referrerPolicyAttribute();
     if (policy != ReferrerPolicyDefault)
         frameLoadRequest.resourceRequest().setHTTPReferrer(SecurityPolicy::generateReferrer(policy, url, document().outgoingReferrer()));
 
+    if (RuntimeEnabledFeatures::embedderCSPEnforcementEnabled() && hasAttribute(HTMLNames::cspAttr) && !getAttribute(HTMLNames::cspAttr).isNull()) {
+        frameLoadRequest.resourceRequest().setHTTPHeaderField(HTTPNames::Embedding_CSP, getAttribute(HTMLNames::cspAttr));
+    }

[Mike West, 2016/09/27 12:14:50]

I think this is going to end up being the wrong place to put this logic. Despite
the name, `loadOrRedirectSubframe` doesn't actually appear to be called during
redirects (which suggests another set of tests to add :) ).

I think you'll have more luck adding the header in `FrameLoader`, which ends up
being responsible for creating a document and stuffing things into it.
`upgradeInsecureRequest()` is ~similar, and called in `FrameLoader::startLoad`.
It might be worth looking into that area of the code to see what you'd need to
do to move this logic around a bit to ensure that it covers the cases you care
about.

I think you'll need to replicate the `csp` value up to `FrameOwner` (that is,
both `HTMLFrameOwnerElement` and `RemoteFrameOwner`) in order to access it in
the loader. Look at things like `WebFrame::setFrameOwnerProperties` to see how
that works, as it's a bit complicated. Basically, the call to
`frameOwnerPropertiesChanged()` in the previous patch needs to grab the new CSP
value, replicate it up to the browser process from the renderer, and then push
it back down to the renderers it creates during navigation. It's probably best
to split that out into a separate patch.

+
     return parentFrame->loader().client()->createFrame(frameLoadRequest, frameName, this);
 }
 
 DEFINE_TRACE(HTMLFrameOwnerElement)
 {
     visitor->trace(m_contentFrame);
     visitor->trace(m_widget);
     HTMLElement::trace(visitor);
     FrameOwner::trace(visitor);
 }
 
 
 } // namespace blink