Experimental Feature: Allow-CSP-From header

third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.h

 /*
  * Copyright (C) 2011 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 335 matching lines @@
   bool experimentalFeaturesEnabled() const;
 
   bool shouldSendCSPHeader(Resource::Type) const;
 
   static bool shouldBypassMainWorld(const ExecutionContext*);
 
   static bool isDirectiveName(const String&);
 
   static bool isNonceableElement(const Element*);
 
+  static bool checkAllowBlanketEnforcement(const ResourceResponse&,

[Mike West, 2016/10/13 11:01:42]

Nit: Perhaps naming this something like `shouldEnforceEmbeddersPolicy()` would
be clearer? We can adjust the spec as well, as I'm no longer sure that "blanket
enforcement" is the right way to talk about this. :)

Nit2: Can you add a comment here describing what the method does, and perhaps
link to https://w3c.github.io/webappsec-csp/embedded/#origin-allowed as well?

+                                           const KURL&);

[Mike West, 2016/10/13 11:01:42]

1. As discussed below, passing an origin here would probably be better.
2. Please add a variable name for things like this, as it's not clear what
URL/Origin we're talking about.

+
   Document* document() const;
 
  private:
   FRIEND_TEST_ALL_PREFIXES(ContentSecurityPolicyTest, NonceInline);
   FRIEND_TEST_ALL_PREFIXES(ContentSecurityPolicyTest, NonceSinglePolicy);
   FRIEND_TEST_ALL_PREFIXES(ContentSecurityPolicyTest, NonceMultiplePolicy);
 
   ContentSecurityPolicy();
 
   void applyPolicySideEffectsToExecutionContext();
@@ skipping 29 matching lines @@
   String m_disableEvalErrorMessage;
   WebInsecureRequestPolicy m_insecureRequestPolicy;
 
   Member<CSPSource> m_selfSource;
   String m_selfProtocol;
 };
 
 }  // namespace blink
 
 #endif