Adding Embedding-CSP HTTP header

third_party/WebKit/Source/core/html/HTMLIFrameElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLIFrameElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLIFrameElement.cpp b/third_party/WebKit/Source/core/html/HTMLIFrameElement.cpp
index 9e956903a26e651ea66d4c1b3b3acaba6a5a5507..8ae6965fee5d1e66f45b98b15eed3030e477e05b 100644
--- a/third_party/WebKit/Source/core/html/HTMLIFrameElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLIFrameElement.cpp
@@ -121,6 +121,11 @@ void HTMLIFrameElement::parseAttribute(const QualifiedName& name, const AtomicSt
         if (initializePermissionsAttribute())
             m_permissions->setValue(value);
     } else if (RuntimeEnabledFeatures::embedderCSPEnforcementEnabled() && name == cspAttr) {
+        if (!value.getString().containsOnlyASCII()) {
+            m_csp = nullAtom;
+            document().addConsoleMessage(ConsoleMessage::create(OtherMessageSource, ErrorMessageLevel, "'csp' attribute contains non-ASCII characters: " + value));
+            return;
+        }

[Mike West, 2016/10/06 08:00:50]

Can you add a TODO here to make the validation a bit more robust? We need to
take care of things like `\r` and `\n` at least.

         AtomicString oldCSP = m_csp;
         m_csp = value;
         if (m_csp != oldCSP)