Implement ContentSecurityPolicy on the browser-side.

third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CSPDirectiveList_h
 #define CSPDirectiveList_h
 
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "core/frame/csp/MediaListDirective.h"
 #include "core/frame/csp/SourceListDirective.h"
 #include "platform/heap/Handle.h"
 #include "platform/loader/fetch/Resource.h"
 #include "platform/network/ContentSecurityPolicyParsers.h"
 #include "platform/network/HTTPParsers.h"
 #include "platform/network/ResourceRequest.h"
 #include "platform/weborigin/KURL.h"
+#include "public/platform/WebContentSecurityPolicy.h"
 #include "wtf/Vector.h"
 #include "wtf/text/AtomicString.h"
 #include "wtf/text/WTFString.h"
 
 namespace blink {
 
 class ContentSecurityPolicy;
 
 typedef HeapVector<Member<SourceListDirective>> SourceListDirectiveVector;
 
@@ skipping 128 matching lines @@
   // browsing context.
   bool hasPluginTypes() const { return !!m_pluginTypes; }
   const String& pluginTypesText() const;
 
   bool shouldSendCSPHeader(Resource::Type) const;
 
   // The algorithm is described here:
   // https://w3c.github.io/webappsec-csp/embedded/#subsume-policy
   bool subsumes(const CSPDirectiveListVector&);
 
+  // Export a subset of the Policy. The primary goal of this method is to make
+  // the embedders aware of the directives that affect navigation, as the
+  // embedder is responsible for navigational enforcement.
+  // It currently contains the following ones:
+  // * default-src
+  // * child-src
+  // * frame-src
+  // * form-action
+  // The exported directives only contains sources that affect navigation. For
+  // instance it doesn't contains 'unsafe-inline' or 'unsafe-eval'
+  WebContentSecurityPolicyPolicy exposeForNavigationalChecks() const;
+
   DECLARE_TRACE();
 
  private:
   FRIEND_TEST_ALL_PREFIXES(CSPDirectiveListTest, IsMatchingNoncePresent);
   FRIEND_TEST_ALL_PREFIXES(CSPDirectiveListTest, GetSourceVector);
   FRIEND_TEST_ALL_PREFIXES(CSPDirectiveListTest, OperativeDirectiveGivenType);
 
   enum RequireSRIForToken { None = 0, Script = 1 << 0, Style = 1 << 1 };
 
   CSPDirectiveList(ContentSecurityPolicy*,
@@ skipping 142 matching lines @@
   uint8_t m_requireSRIFor;
 
   Vector<String> m_reportEndpoints;
 
   String m_evalDisabledErrorMessage;
 };
 
 }  // namespace blink
 
 #endif