Remove CSP referrer directive

third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp

Index: third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp
diff --git a/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp b/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp
index 10c3665d7f81fa19c4a74df0672861de564d469d..d9e733aaf46e17b4f4d0867c569ce535cadc5cfb 100644
--- a/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp
+++ b/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp
@@ -92,7 +92,6 @@ const char ContentSecurityPolicy::ChildSrc[] = "child-src";
 const char ContentSecurityPolicy::FormAction[] = "form-action";
 const char ContentSecurityPolicy::FrameAncestors[] = "frame-ancestors";
 const char ContentSecurityPolicy::PluginTypes[] = "plugin-types";
-const char ContentSecurityPolicy::Referrer[] = "referrer";
 
 // CSP Editor's Draft:
 // https://w3c.github.io/webappsec/specs/content-security-policy
@@ -126,7 +125,6 @@ bool ContentSecurityPolicy::isDirectiveName(const String& name) {
       equalIgnoringCase(name, FormAction) ||
       equalIgnoringCase(name, FrameAncestors) ||
       equalIgnoringCase(name, PluginTypes) ||
-      equalIgnoringCase(name, Referrer) ||
       equalIgnoringCase(name, ManifestSrc) ||
       equalIgnoringCase(name, BlockAllMixedContent) ||
       equalIgnoringCase(name, UpgradeInsecureRequests) ||
@@ -191,7 +189,6 @@ ContentSecurityPolicy::ContentSecurityPolicy()
       m_scriptHashAlgorithmsUsed(ContentSecurityPolicyHashAlgorithmNone),
       m_styleHashAlgorithmsUsed(ContentSecurityPolicyHashAlgorithmNone),
       m_sandboxMask(0),
-      m_referrerPolicy(ReferrerPolicyDefault),
       m_treatAsPublicAddress(false),
       m_insecureRequestPolicy(kLeaveInsecureRequestsAlone) {}
 
@@ -215,9 +212,6 @@ void ContentSecurityPolicy::applyPolicySideEffectsToExecutionContext() {
 
   setupSelf(*m_executionContext->securityContext().getSecurityOrigin());
 
-  if (didSetReferrerPolicy())
-    m_executionContext->setReferrerPolicy(m_referrerPolicy);
-
   // If we're in a Document, set mixed content checking and sandbox
   // flags, then dump all the parsing error messages, then poke at histograms.
   if (Document* document = this->document()) {
@@ -364,12 +358,6 @@ void ContentSecurityPolicy::addPolicyFromHeaderValue(
     Member<CSPDirectiveList> policy =
         CSPDirectiveList::create(this, begin, position, type, source);
 
-    // When a referrer policy has already been set, the most recent
-    // one takes precedence.
-    if (type != ContentSecurityPolicyHeaderTypeReport &&
-        policy->didSetReferrerPolicy())
-      m_referrerPolicy = policy->getReferrerPolicy();
-
     if (!policy->allowEval(0, SuppressReport) &&
         m_disableEvalErrorMessage.isNull())
       m_disableEvalErrorMessage = policy->evalDisabledErrorMessage();
@@ -1008,14 +996,6 @@ bool ContentSecurityPolicy::isActive() const {
   return !m_policies.isEmpty();
 }
 
-bool ContentSecurityPolicy::didSetReferrerPolicy() const {
-  for (const auto& policy : m_policies) {
-    if (policy->didSetReferrerPolicy())
-      return true;
-  }
-  return false;
-}
-
 const KURL ContentSecurityPolicy::url() const {
   return m_executionContext->contextURL();
 }
@@ -1272,15 +1252,6 @@ void ContentSecurityPolicy::reportMixedContent(const KURL& mixedURL,
     policy->reportMixedContent(mixedURL, redirectStatus);
 }
 
-void ContentSecurityPolicy::reportInvalidReferrer(const String& invalidValue) {
-  logToConsole(
-      "The 'referrer' Content Security Policy directive has the invalid value "
-      "\"" +
-      invalidValue +
-      "\". Valid values are \"no-referrer\", \"no-referrer-when-downgrade\", "
-      "\"origin\", \"origin-when-cross-origin\", and \"unsafe-url\".");
-}
-
 void ContentSecurityPolicy::reportReportOnlyInMeta(const String& header) {
   logToConsole("The report-only Content Security Policy '" + header +
                "' was delivered via a <meta> element, which is disallowed. The "