Implement ContentSecurityPolicy on the browser-side.

content/common/content_security_policy/csp_context.h

Index: content/common/content_security_policy/csp_context.h
diff --git a/content/common/content_security_policy/csp_context.h b/content/common/content_security_policy/csp_context.h
new file mode 100644
index 0000000000000000000000000000000000000000..a7573defdfcf8861023052b2aa6cdfc1a3f5423c
--- /dev/null
+++ b/content/common/content_security_policy/csp_context.h
@@ -0,0 +1,57 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_COMMON_CONTENT_SECURITY_POLICY_CSP_CONTEXT_H_
+#define CONTENT_COMMON_CONTENT_SECURITY_POLICY_CSP_CONTEXT_H_
+
+#include <vector>
+
+#include "content/common/content_export.h"
+#include "content/common/content_security_policy/csp_policy.h"
+#include "content/common/content_security_policy_header.h"
+#include "url/gurl.h"
+#include "url/origin.h"
+
+namespace content {
+
+// A CSPContext define every dependencies that have to be implemented to be

[Mike West, 2017/02/15 16:18:18]

I don't really understand what this means. What dependencies? Implemented by
whom?

[arthursonzogni, 2017/02/16 13:30:25]

What dependencies?
The functionality defined here that are behind a virtual method :
{
  LogToConsole,
  ReportViolation,
  SchemeShouldByPassCSP
}

Whom?
The one that want to use any class inside this directory.
In https://codereview.chromium.org/2655463006/, CSPContext_impl is one possible
implementation of CSPContext.

In:
* csp_policy_unittest
* csp_source_list_unittest
* csp_source
it is implemented in another way.

But yes, I will improve this comment.

+// able to check the Content-Security-Policy and report violations to the users.
+class CONTENT_EXPORT CSPContext {
+ public:
+  CSPContext();
+  virtual ~CSPContext();
+
+  bool Allow(const std::vector<CSPPolicy>& policies,
+             CSPDirective::Name directive_name,
+             const GURL& url,
+             bool is_redirect = false);
+
+  void SetSelf(const url::Origin origin);
+  bool AllowSelf(const GURL& url);
+  bool ProtocolMatchesSelf(const GURL& url);
+
+  virtual void LogToConsole(const std::string& message);
+  virtual void ReportViolation(
+      const std::string& directive_text,
+      const std::string& effective_directive,
+      const std::string& message,
+      const GURL& blocked_url,
+      const std::vector<std::string>& report_end_points,
+      const std::string& header,
+      blink::WebContentSecurityPolicyType disposition);
+
+  bool SelfSchemeShouldBypassCSP();
+
+ private:
+  virtual bool SchemeShouldBypassCSP(const base::StringPiece& scheme);
+
+  bool has_self_ = false;
+  std::string self_scheme_;
+  CSPSource self_source_;
+
+  DISALLOW_COPY_AND_ASSIGN(CSPContext);
+};
+
+}  // namespace content
+#endif  // CONTENT_COMMON_CONTENT_SECURITY_POLICY_CSP_CONTEXT_H_