Implement ContentSecurityPolicy on the browser-side.

third_party/WebKit/Source/core/frame/csp/SourceListDirective.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef SourceListDirective_h
 #define SourceListDirective_h
 
 #include "core/CoreExport.h"
 #include "core/frame/csp/CSPDirective.h"
 #include "core/frame/csp/CSPSource.h"
 #include "platform/Crypto.h"
 #include "platform/network/ContentSecurityPolicyParsers.h"
 #include "platform/network/ResourceRequest.h"
+#include "public/platform/WebContentSecurityPolicy.h"
 #include "wtf/HashSet.h"
 #include "wtf/text/WTFString.h"
 
 namespace blink {
 
 class ContentSecurityPolicy;
 class KURL;
 
 class CORE_EXPORT SourceListDirective final : public CSPDirective {
   WTF_MAKE_NONCOPYABLE(SourceListDirective);
@@ skipping 21 matching lines @@
   bool allowHashedAttributes() const;
   bool isNone() const;
   bool isHashOrNoncePresent() const;
   uint8_t hashAlgorithmsUsed() const;
   bool allowAllInline() const;
 
   // The algorothm is described more extensively here:
   // https://w3c.github.io/webappsec-csp/embedded/#subsume-source-list
   bool subsumes(const HeapVector<Member<SourceListDirective>>&) const;
 
+  // Export a subset of the source list that can be checked outside of blink.

[Mike West, 2017/02/15 16:18:18]

Again, I'd suggest making the link to navigational checks clear.

+  // It contains every source-expressions, '*', 'none' and 'self'.
+  // It doesn't contain 'unsafe-inline' or 'unsafe-eval' for instance.
+  WebContentSecurityPolicySourceList expose() const;

[Mike West, 2017/02/15 16:18:18]

Maybe we should rename these to something like `exposeForNavigationalChecks`?

[arthursonzogni, 2017/02/16 13:30:25]

I agree. Done.

+  String directiveName() const { return m_directiveName; }
+
  private:
   FRIEND_TEST_ALL_PREFIXES(SourceListDirectiveTest, GetIntersectCSPSources);
   FRIEND_TEST_ALL_PREFIXES(SourceListDirectiveTest,
                            GetIntersectCSPSourcesSchemes);
   FRIEND_TEST_ALL_PREFIXES(SourceListDirectiveTest, GetIntersectNonces);
   FRIEND_TEST_ALL_PREFIXES(SourceListDirectiveTest, GetIntersectHashes);
   FRIEND_TEST_ALL_PREFIXES(SourceListDirectiveTest, GetSources);
   FRIEND_TEST_ALL_PREFIXES(SourceListDirectiveTest, ParseHost);
   FRIEND_TEST_ALL_PREFIXES(CSPDirectiveListTest, GetSourceVector);
   FRIEND_TEST_ALL_PREFIXES(CSPDirectiveListTest, OperativeDirectiveGivenType);
@@ skipping 57 matching lines @@
   bool m_allowDynamic;
   bool m_allowHashedAttributes;
   HashSet<String> m_nonces;
   HashSet<CSPHashValue> m_hashes;
   uint8_t m_hashAlgorithmsUsed;
 };
 
 }  // namespace blink
 
 #endif