PlzNavigate: Enforce 'frame-src' CSP on the browser.

content/browser/frame_host/csp_context_impl.cc

+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <algorithm>
+
+#include "content/browser/frame_host/csp_context_impl.h"
+#include "content/browser/frame_host/frame_tree_node.h"
+#include "url/url_util.h"
+
+namespace content {
+
+CSPContextImpl::CSPContextImpl(FrameTreeNode* frame_tree_node)
+    : frame_tree_node_(frame_tree_node) {
+  DCHECK(frame_tree_node_);
+}
+
+void CSPContextImpl::LogToConsole(const std::string& message) {
+  RenderFrameHostImpl* current_frame_host =
+      frame_tree_node_->current_frame_host();
+
+  if (!current_frame_host)
+    return;
+
+  current_frame_host->AddMessageToConsole(CONSOLE_MESSAGE_LEVEL_ERROR, message);
+}
+
+void CSPContextImpl::ReportViolation(
+    const CSPViolationParams& violation_params) {
+  frame_tree_node_->current_frame_host()->ContentSecurityPolicyViolation(
+      violation_params);
+}
+
+bool CSPContextImpl::SchemeShouldBypassCSP(const base::StringPiece& scheme) {
+  // Blink uses its SchemeRegistry to check if a scheme should be bypassed.
+  // It can't be used on the browser process. It is used for two things:
+  // 1) Bypassing the "chrome-extension" scheme when chrome is built with the
+  //    extensions support.
+  // 2) Bypassing arbitrary scheme for testing purpose only in blink and in V8.
+  // TODO(arthursonzogni): url::GetBypassingCSPScheme() is used instead of the
+  // blink::SchemeRegistry. It contains 1) but not 2).
+  const auto& bypassing_schemes = url::GetCSPBypassingSchemes();
+  return std::find(bypassing_schemes.begin(), bypassing_schemes.end(),
+                   scheme) != bypassing_schemes.end();
+}
+
+}  // namespace content