Implement ContentSecurityPolicy on the browser-side.

content/renderer/render_frame_impl.cc

Index: content/renderer/render_frame_impl.cc
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 11e7198d70cf15b155ba0bac452aacadb0a4cd91..c0c9445683f0dd2cc48d7aa183289784df785d9a 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -52,6 +52,7 @@
 #include "content/common/associated_interfaces.mojom.h"
 #include "content/common/clipboard_messages.h"
 #include "content/common/content_constants_internal.h"
+#include "content/common/content_security_policy/csp_context.h"
 #include "content/common/content_security_policy_header.h"
 #include "content/common/download/mhtml_save_status.h"
 #include "content/common/edit_command.h"
@@ -3196,14 +3197,16 @@ void RenderFrameImpl::didAddContentSecurityPolicy(
     const blink::WebString& header_value,
     blink::WebContentSecurityPolicyType type,
     blink::WebContentSecurityPolicySource source) {
-  if (!SiteIsolationPolicy::AreCrossProcessFramesPossible())
-    return;
+  //if (!SiteIsolationPolicy::AreCrossProcessFramesPossible())

[nasko, 2017/01/23 22:54:50]

nit: Hopefully not committing this, right? :)

+    //return;
 
   ContentSecurityPolicyHeader header;
   header.header_value = base::UTF16ToUTF8(base::StringPiece16(header_value));
   header.type = type;
   header.source = source;
-  Send(new FrameHostMsg_DidAddContentSecurityPolicy(routing_id_, header));
+  CSPContext context;
+  Send(new FrameHostMsg_DidAddContentSecurityPolicy(
+      routing_id_, header, CSPPolicy::Parse(&context, header)));
 }
 
 void RenderFrameImpl::didChangeFrameOwnerProperties(