CSP: 'connect-src' should not cause exceptions.

third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp

 /*
  *  Copyright (C) 2004, 2006, 2008 Apple Inc. All rights reserved.
  *  Copyright (C) 2005-2007 Alexey Proskuryakov <ap@webkit.org>
  *  Copyright (C) 2007, 2008 Julien Chaffraix <jchaffraix@webkit.org>
  *  Copyright (C) 2008, 2011 Google Inc. All rights reserved.
  *  Copyright (C) 2012 Intel Corporation
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
  *  License as published by the Free Software Foundation; either
@@ skipping 599 matching lines @@
   DCHECK(validateOpenArguments(method, url, exceptionState));
 
   if (!internalAbort())
     return;
 
   State previousState = m_state;
   m_state = kUnsent;
   m_error = false;
   m_uploadComplete = false;
 
-  if (!ContentSecurityPolicy::shouldBypassMainWorld(getExecutionContext()) &&
-      !getExecutionContext()->contentSecurityPolicy()->allowConnectToSource(
-          url)) {
-    // We can safely expose the URL to JavaScript, as these checks happen
-    // synchronously before redirection. JavaScript receives no new information.
-    exceptionState.throwSecurityError(
-        "Refused to connect to '" + url.elidedString() +
-        "' because it violates the document's Content Security Policy.");
-    return;
-  }
-
   if (!async && getExecutionContext()->isDocument()) {
     if (document()->settings() &&
         !document()->settings()->getSyncXHRInDocumentsEnabled()) {
       exceptionState.throwDOMException(
           InvalidAccessError,
           "Synchronous requests are disabled for this page.");
       return;
     }
 
     // Newer functionality is not available to synchronous requests in window
@@ skipping 1252 matching lines @@
   visitor->traceWrappers(m_responseDocument);
   visitor->traceWrappers(m_responseArrayBuffer);
   XMLHttpRequestEventTarget::traceWrappers(visitor);
 }
 
 std::ostream& operator<<(std::ostream& ostream, const XMLHttpRequest* xhr) {
   return ostream << "XMLHttpRequest " << static_cast<const void*>(xhr);
 }
 
 }  // namespace blink