Adding Embedding-CSP HTTP header

third_party/WebKit/Source/core/loader/FrameLoader.cpp

Index: third_party/WebKit/Source/core/loader/FrameLoader.cpp
diff --git a/third_party/WebKit/Source/core/loader/FrameLoader.cpp b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
index af4d71268aead1e1b8211453e5ba162035ffb0b9..dca64590b9a11343fdb3bc3ebaa732d331d8ee40 100644
--- a/third_party/WebKit/Source/core/loader/FrameLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
@@ -174,6 +174,7 @@ ResourceRequest FrameLoader::resourceRequestForReload(FrameLoadType frameLoadTyp
 
 FrameLoader::FrameLoader(LocalFrame* frame)
     : m_frame(frame)
+    , m_requiredCSP(nullAtom)
     , m_progressTracker(ProgressTracker::create(frame))
     , m_loadType(FrameLoadTypeStandard)
     , m_inStopAllLoaders(false)
@@ -1440,7 +1441,10 @@ void FrameLoader::startLoad(FrameLoadRequest& frameLoadRequest, FrameLoadType ty
     frameLoadRequest.resourceRequest().setRequestContext(determineRequestContextFromNavigationType(navigationType));
     frameLoadRequest.resourceRequest().setFrameType(m_frame->isMainFrame() ? WebURLRequest::FrameTypeTopLevel : WebURLRequest::FrameTypeNested);
     ResourceRequest& request = frameLoadRequest.resourceRequest();
-    upgradeInsecureRequest(request, nullptr);
+
+    // Record the latest requiredCSP value that will be used when sending this request.
+    recordLatestRequiredCSP();
+    addOutgoingSecurityHeaders(request, nullptr);
     if (!shouldContinueForNavigationPolicy(request, frameLoadRequest.substituteData(), nullptr, frameLoadRequest.shouldCheckMainWorldContentSecurityPolicy(), navigationType, navigationPolicy, type == FrameLoadTypeReplaceCurrentItem, frameLoadRequest.clientRedirect() == ClientRedirectPolicy::ClientRedirect, frameLoadRequest.form()))
         return;
 
@@ -1623,8 +1627,11 @@ SecurityContext::InsecureNavigationsSet* FrameLoader::insecureNavigationsToUpgra
     return toLocalFrame(parentFrame)->document()->insecureNavigationsToUpgrade();
 }
 
-void FrameLoader::upgradeInsecureRequest(ResourceRequest& resourceRequest, Document* document) const
+void FrameLoader::addOutgoingSecurityHeaders(ResourceRequest& resourceRequest, Document* document) const

[Mike West, 2016/09/30 13:11:49]

Hrm. I think it makes more sense to pull out the header-setting bits into a new
function. The upgrading bits from 1646 on don't have anything to do with setting
security headers.

 {
+    if (RuntimeEnabledFeatures::embedderCSPEnforcementEnabled() && !requiredCSP().isEmpty())
+        resourceRequest.setHTTPHeaderField(HTTPNames::Embedding_CSP, requiredCSP());
+
     // Tack an 'Upgrade-Insecure-Requests' header to outgoing navigational requests, as described in
     // https://w3c.github.io/webappsec/specs/upgrade/#feature-detect
     if (resourceRequest.frameType() != WebURLRequest::FrameTypeNone) {
@@ -1661,6 +1668,10 @@ void FrameLoader::upgradeInsecureRequest(ResourceRequest& resourceRequest, Docum
     }
 }
 
+void FrameLoader::recordLatestRequiredCSP()
+{
+    m_requiredCSP = m_frame->owner() ? m_frame->owner()->csp() : nullAtom;
+}
 
 std::unique_ptr<TracedValue> FrameLoader::toTracedValue() const
 {