Add a configurable parse-depth limit when parsing JFV headers, and use it for Feature-Policy Header

third_party/WebKit/Source/platform/network/HTTPParsers.h

 /*
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2009 Google Inc. All rights reserved.
  * Copyright (C) 2011 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
@@ skipping 144 matching lines @@
 
 // Returns true and stores the position of the end of the headers to |*end|
 // if the headers part ends in |bytes[0..size]|. Returns false otherwise.
 PLATFORM_EXPORT bool parseMultipartHeadersFromBody(const char* bytes,
                                                    size_t,
                                                    ResourceResponse*,
                                                    size_t* end);
 
 // Parses a header value containing JSON data, according to
 // https://tools.ietf.org/html/draft-ietf-httpbis-jfv-01
-// Returns an empty unique_ptr if the header cannot be parsed as JSON.
-PLATFORM_EXPORT std::unique_ptr<JSONArray> parseJSONHeader(
-    const String& header);
+// Returns an empty unique_ptr if the header cannot be parsed as JSON. JSON
+// strings which represent object nested deeper than |maxParseDepth| will also
+// cause an empty return value.
+PLATFORM_EXPORT std::unique_ptr<JSONArray> parseJSONHeader(const String& header,
+                                                           int maxParseDepth);
 
 }  // namespace blink
 
 #endif