Adding Embedding-CSP HTTP header

third_party/WebKit/Source/core/html/HTMLIFrameElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLIFrameElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLIFrameElement.cpp b/third_party/WebKit/Source/core/html/HTMLIFrameElement.cpp
index 9e956903a26e651ea66d4c1b3b3acaba6a5a5507..466242d9f1139a588ebb5ddc0698b918f0181e9a 100644
--- a/third_party/WebKit/Source/core/html/HTMLIFrameElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLIFrameElement.cpp
@@ -121,6 +121,12 @@ void HTMLIFrameElement::parseAttribute(const QualifiedName& name, const AtomicSt
         if (initializePermissionsAttribute())
             m_permissions->setValue(value);
     } else if (RuntimeEnabledFeatures::embedderCSPEnforcementEnabled() && name == cspAttr) {
+        for (size_t i = 0; i < value.length(); ++i) {

[Mike West, 2016/09/29 13:33:13]

You can replace this loop with `value.containsOnlyASCII()` (defined in
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/wtf/text/WTFSt...,
but you can cast an `AtomicString` to `WTF::String` without copying, so it's
fairly cheap).

+            if (!isASCII(value[i])) {
+                document().addConsoleMessage(ConsoleMessage::create(OtherMessageSource, ErrorMessageLevel, "'csp' attribute contains non-ASCII characters: " + value));
+                return;
+            }
+        }
         AtomicString oldCSP = m_csp;
         m_csp = value;
         if (m_csp != oldCSP)