Implement ContentSecurityPolicy on the browser-side.

third_party/WebKit/public/platform/WebContentSecurityPolicyStruct.h

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 10 matching lines @@
  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebContentSecurityPolicy_h
-#define WebContentSecurityPolicy_h
+#ifndef WebContentSecurityPolicyStruct_h
+#define WebContentSecurityPolicyStruct_h
+
+#include "public/platform/WebContentSecurityPolicy.h"
+#include "public/platform/WebString.h"
+#include "public/platform/WebVector.h"
 
 namespace blink {
 
-enum WebContentSecurityPolicyType {
-  WebContentSecurityPolicyTypeReport,
-  WebContentSecurityPolicyTypeEnforce,
-  WebContentSecurityPolicyTypeLast = WebContentSecurityPolicyTypeEnforce
+struct WebContentSecurityPolicySourceExpression {
+  WebString scheme;
+  WebString host;
+  bool isHostWildcard;
+  int port;
+  bool isPortWildcard;
+  WebString path;
 };
 
-enum WebContentSecurityPolicySource {
-  WebContentSecurityPolicySourceHTTP,
-  WebContentSecurityPolicySourceMeta,
-  WebContentSecurityPolicySourceLast = WebContentSecurityPolicySourceMeta
+struct WebContentSecurityPolicySourceList {
+  bool allowSelf;
+  bool allowStar;
+  WebVector<WebContentSecurityPolicySourceExpression> sourceList;

[Mike West, 2017/02/13 14:10:51]

Nit: `sourceList` seems wrong, given the name of the struct. Perhaps
`expressionList`? Or `expressions`?

[arthursonzogni, 2017/02/14 17:07:03]

I agree. What about sources?

[Mike West, 2017/02/15 16:18:17]

SGTM.

+};
+
+struct WebContentSecurityPolicyDirective {
+  WebString name;
+  WebContentSecurityPolicySourceList sourceList;
+};

[Mike West, 2017/02/13 14:10:51]

Since you're only exporting source-list directives, it's not clear to me that
you need the extra struct. Perhaps you could drop the source list, and expand
`WebContentSecurityPolicyDirective` to include a list of expressions?

[arthursonzogni, 2017/02/14 17:07:03]

I prefer to store a list of CSPDirective inside a CSPPolicy instead of storing a
list of Pair<DirectiveName, CSPSourceList>.

I don't know why I didn't used a map<DirectiveName, CSPSourceList>, maybe
because these structs are transmitted through IPC.

[Mike West, 2017/02/15 16:18:17]

I think you're adding complexity for little benefit. *shrug* I won't block on
this, but I don't see much value in the indirection.

+
+struct WebContentSecurityPolicyPolicy {

[Mike West, 2017/02/13 14:10:51]

Nit: ContentSecurityPolicyPolicy sounds super-weird. How about dropping the last
`Policy`?

[arthursonzogni, 2017/02/14 17:07:03]

Inside blink, a ContentSecurityPolicy doesn't represent a policy, but a set of
policies (+ a ton of other things). So maybe dropping the Policy could cause
confusion. The real CSPPolicy class in blink is the CSPDirectiveList.

I would like to abbreviate ContentSecurityPolicy into CSP. But I think it is
against blink coding style.

So, yes maybe dropping the Policy if we don't have a better idea.

[Mike West, 2017/02/15 16:18:17]

Blink is serving a few masters with the naming: we wrap up all the CSP-related
functionality into a `ContentSecurityPolicy` class, which more or less maps to
what the spec now calls a "CSP List"
(https://html.spec.whatwg.org/multipage/dom.html#concept-document-csp-list). I
think that naming makes sense, given the way it's used (we call into certain
algorithms which operate on the document context).

I'd be fine with you replicating that structure in the browser, but that doesn't
seem to be what you're doing. *shrug*
I think it made sense to spell everything out when we first added the feature,
since no one could be expected to know what CSP meant. I suspect we could change
that today without much argument.
Please do. Or call it a "directive list" to match Blink. Whatever works for you.

+  WebContentSecurityPolicyType disposition;
+  WebContentSecurityPolicySource source;
+  WebVector<WebContentSecurityPolicyDirective> directives;
+  WebVector<WebString> reportEndpoints;
 };
 
 }  // namespace blink
 
 #endif