Implement ContentSecurityPolicy on the browser-side.

third_party/WebKit/public/platform/WebContentSecurityPolicyStruct.h

Index: third_party/WebKit/public/platform/WebContentSecurityPolicyStruct.h
diff --git a/third_party/WebKit/public/web/WebContentSecurityPolicy.h b/third_party/WebKit/public/platform/WebContentSecurityPolicyStruct.h
similarity index 65%
rename from third_party/WebKit/public/web/WebContentSecurityPolicy.h
rename to third_party/WebKit/public/platform/WebContentSecurityPolicyStruct.h
index 704d43dc676bff887bddddb9afc9901e6149b988..53244f5b9144721311be388b24bad6b466040af1 100644
--- a/third_party/WebKit/public/web/WebContentSecurityPolicy.h
+++ b/third_party/WebKit/public/platform/WebContentSecurityPolicyStruct.h
@@ -28,21 +28,40 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebContentSecurityPolicy_h
-#define WebContentSecurityPolicy_h
+#ifndef WebContentSecurityPolicyStruct_h
+#define WebContentSecurityPolicyStruct_h
+
+#include "public/platform/WebContentSecurityPolicy.h"
+#include "public/platform/WebString.h"
+#include "public/platform/WebVector.h"
 
 namespace blink {
 
-enum WebContentSecurityPolicyType {
-  WebContentSecurityPolicyTypeReport,
-  WebContentSecurityPolicyTypeEnforce,
-  WebContentSecurityPolicyTypeLast = WebContentSecurityPolicyTypeEnforce
+struct WebContentSecurityPolicySourceExpression {
+  WebString scheme;
+  WebString host;
+  bool isHostWildcard;
+  int port;
+  bool isPortWildcard;
+  WebString path;
+};
+
+struct WebContentSecurityPolicySourceList {
+  bool allowSelf;
+  bool allowStar;
+  WebVector<WebContentSecurityPolicySourceExpression> sourceList;

[Mike West, 2017/02/13 14:10:51]

Nit: `sourceList` seems wrong, given the name of the struct. Perhaps
`expressionList`? Or `expressions`?

[arthursonzogni, 2017/02/14 17:07:03]

I agree. What about sources?

[Mike West, 2017/02/15 16:18:17]

SGTM.

+};
+
+struct WebContentSecurityPolicyDirective {
+  WebString name;
+  WebContentSecurityPolicySourceList sourceList;
 };

[Mike West, 2017/02/13 14:10:51]

Since you're only exporting source-list directives, it's not clear to me that
you need the extra struct. Perhaps you could drop the source list, and expand
`WebContentSecurityPolicyDirective` to include a list of expressions?

[arthursonzogni, 2017/02/14 17:07:03]

I prefer to store a list of CSPDirective inside a CSPPolicy instead of storing a
list of Pair<DirectiveName, CSPSourceList>.

I don't know why I didn't used a map<DirectiveName, CSPSourceList>, maybe
because these structs are transmitted through IPC.

[Mike West, 2017/02/15 16:18:17]

I think you're adding complexity for little benefit. *shrug* I won't block on
this, but I don't see much value in the indirection.

 
-enum WebContentSecurityPolicySource {
-  WebContentSecurityPolicySourceHTTP,
-  WebContentSecurityPolicySourceMeta,
-  WebContentSecurityPolicySourceLast = WebContentSecurityPolicySourceMeta
+struct WebContentSecurityPolicyPolicy {

[Mike West, 2017/02/13 14:10:51]

Nit: ContentSecurityPolicyPolicy sounds super-weird. How about dropping the last
`Policy`?

[arthursonzogni, 2017/02/14 17:07:03]

Inside blink, a ContentSecurityPolicy doesn't represent a policy, but a set of
policies (+ a ton of other things). So maybe dropping the Policy could cause
confusion. The real CSPPolicy class in blink is the CSPDirectiveList.

I would like to abbreviate ContentSecurityPolicy into CSP. But I think it is
against blink coding style.

So, yes maybe dropping the Policy if we don't have a better idea.

[Mike West, 2017/02/15 16:18:17]

Blink is serving a few masters with the naming: we wrap up all the CSP-related
functionality into a `ContentSecurityPolicy` class, which more or less maps to
what the spec now calls a "CSP List"
(https://html.spec.whatwg.org/multipage/dom.html#concept-document-csp-list). I
think that naming makes sense, given the way it's used (we call into certain
algorithms which operate on the document context).

I'd be fine with you replicating that structure in the browser, but that doesn't
seem to be what you're doing. *shrug*
I think it made sense to spell everything out when we first added the feature,
since no one could be expected to know what CSP meant. I suspect we could change
that today without much argument.
Please do. Or call it a "directive list" to match Blink. Whatever works for you.

+  WebContentSecurityPolicyType disposition;
+  WebContentSecurityPolicySource source;
+  WebVector<WebContentSecurityPolicyDirective> directives;
+  WebVector<WebString> reportEndpoints;
 };
 
 }  // namespace blink