Experimental Feature: Allow-CSP-From header

third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp

 /*
  * Copyright (C) 2011 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 293 matching lines @@
     ContentSecurityPolicyHeaderType type,
     ContentSecurityPolicyHeaderSource source) {
   addAndReportPolicyFromHeaderValue(header, type, source);
 
   // This might be called after we've been bound to an execution context. For
   // example, a <meta> element might be injected after page load.
   if (m_executionContext)
     applyPolicySideEffectsToExecutionContext();
 }
 
+bool ContentSecurityPolicy::shouldEnforceEmbeddersPolicy(

[Mike West, 2016/10/14 09:01:17]

Can you add some unit tests for this method in `ContentSecurityPolicyTest.cpp`?

+    const ResourceResponse& response,
+    SecurityOrigin* parentOrigin) {
+  if (response.url().isEmpty() || response.url().protocolIsAbout() ||
+      response.url().protocolIsData() || response.url().protocolIs("blob") ||
+      response.url().protocolIs("filesystem")) {
+    return true;
+  }
+
+  if (parentOrigin->canAccess(SecurityOrigin::create(response.url()).get()))
+    return true;
+
+  String header = response.httpHeaderField(HTTPNames::Allow_CSP_From);
+  if (header.isEmpty() || !header.containsOnlyASCII())
+    return false;
+
+  String headerValue = header.stripWhiteSpace();
+  if (headerValue == "*" ||
+      parentOrigin->canAccess(
+          SecurityOrigin::createFromString(headerValue).get()))

[Mike West, 2016/10/14 09:01:17]

I think you can simplify the logic here a bit with something like:

```
String header = response.httpHeaderField(HTTPNames::Allow_CSP_From);
header = header.stripWhiteSpace();
if (header == "*")
  return true;
if (RefPtr<SecurityOrigin> childOrigin =
SecurityOrigin::createFromString(header))
  return parentOrigin->canAccess(childOrigin);

return false;
```

+    return true;

[Mike West, 2016/10/14 09:01:17]

Nit: `{}` around the body if the `if` clause is multi-line.

+
+  return false;
+}
+
 void ContentSecurityPolicy::addPolicyFromHeaderValue(
     const String& header,
     ContentSecurityPolicyHeaderType type,
     ContentSecurityPolicyHeaderSource source) {
   // If this is a report-only header inside a <meta> element, bail out.
   if (source == ContentSecurityPolicyHeaderSourceMeta &&
       type == ContentSecurityPolicyHeaderTypeReport) {
     reportReportOnlyInMeta(header);
     return;
   }
@@ skipping 1155 matching lines @@
   // Collisions have no security impact, so we can save space by storing only
   // the string's hash rather than the whole report.
   return !m_violationReportsSent.contains(report.impl()->hash());
 }
 
 void ContentSecurityPolicy::didSendViolationReport(const String& report) {
   m_violationReportsSent.add(report.impl()->hash());
 }
 
 }  // namespace blink