PlzNavigate: Enforce 'frame-src' CSP on the browser.

content/browser/frame_host/navigation_handle_impl.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_BROWSER_FRAME_HOST_NAVIGATION_HANDLE_IMPL_H_
 #define CONTENT_BROWSER_FRAME_HOST_NAVIGATION_HANDLE_IMPL_H_
 
 #include "content/public/browser/navigation_handle.h"
 
 #include <stddef.h>
@@ skipping 73 matching lines @@
   // PlzNavigate: This value always comes from the CommonNavigationParams
   // associated with this navigation.
   static std::unique_ptr<NavigationHandleImpl> Create(
       const GURL& url,
       const std::vector<GURL>& redirect_chain,
       FrameTreeNode* frame_tree_node,
       bool is_renderer_initiated,
       bool is_same_page,
       const base::TimeTicks& navigation_start,
       int pending_nav_entry_id,
-      bool started_from_context_menu);
+      bool started_from_context_menu,
+      bool should_bypass_main_world_csp);
   ~NavigationHandleImpl() override;
 
   // NavigationHandle implementation:
   const GURL& GetURL() override;
   SiteInstance* GetStartingSiteInstance() override;
   bool IsInMainFrame() override;
   bool IsParentMainFrame() override;
   bool IsRendererInitiated() override;
   bool WasServerRedirect() override;
   const std::vector<GURL>& GetRedirectChain() override;
@@ skipping 36 matching lines @@
       RenderFrameHost* render_frame_host,
       const std::string& raw_response_header) override;
   void CallDidCommitNavigationForTesting(const GURL& url) override;
   bool WasStartedFromContextMenu() const override;
   const GURL& GetSearchableFormURL() override;
   const std::string& GetSearchableFormEncoding() override;
   ReloadType GetReloadType() override;
   const GlobalRequestID& GetGlobalRequestID() override;
 
   NavigationData* GetNavigationData() override;
+  bool should_bypass_main_world_csp() const override;
 
   // The NavigatorDelegate to notify/query for various navigation events.
   // Normally this is the WebContents, except if this NavigationHandle was
   // created during a navigation to an interstitial page. In this case it will
   // be the InterstitialPage itself.
   //
   // Note: due to the interstitial navigation case, all calls that can possibly
   // expose the NavigationHandle to code outside of content/ MUST go though the
   // NavigatorDelegate. In particular, the ContentBrowserClient should not be
   // called directly form the NavigationHandle code. Thus, these calls will not
@@ skipping 183 matching lines @@
     DID_COMMIT_ERROR_PAGE,
   };
 
   NavigationHandleImpl(const GURL& url,
                        const std::vector<GURL>& redirect_chain,
                        FrameTreeNode* frame_tree_node,
                        bool is_renderer_initiated,
                        bool is_same_page,
                        const base::TimeTicks& navigation_start,
                        int pending_nav_entry_id,
-                       bool started_from_context_menu);
+                       bool started_from_context_menu,
+                       bool should_bypass_main_world_csp);
 
   NavigationThrottle::ThrottleCheckResult CheckWillStartRequest();
   NavigationThrottle::ThrottleCheckResult CheckWillRedirectRequest();
   NavigationThrottle::ThrottleCheckResult CheckWillProcessResponse();
 
   // Called when WillProcessResponse checks are done, to find the final
   // RenderFrameHost for the navigation. Checks whether the navigation should be
   // transferred. Returns false if the transfer attempt results in the
   // destruction of this NavigationHandle and the navigation should no longer
   // proceed. This can happen when the RenderFrameHostManager determines a
@@ skipping 118 matching lines @@
   ReloadType reload_type_;
 
   GURL searchable_form_url_;
   std::string searchable_form_encoding_;
 
   GURL previous_url_;
   GURL base_url_;
   net::HostPortPair socket_address_;
   NavigationType navigation_type_;
 
+  // Whether or not the navigation has been issued by a content script or an

[nasko, 2017/02/15 21:28:44]

nit: content script is an extensions system detail that probably doesn't belong
in content/. What matters is whether it was issued by an isolated world, which
is the web platform concept we should be using.

[arthursonzogni, 2017/02/16 17:32:41]

Okay, I don't know exactly know what is a content script. I added this comment
on alexmos@ suggestion.

+  // isolated world, for instance from a chrome extension. When true, the
+  // navigation should not be blocked by the parent frame's CSP.
+  bool should_bypass_main_world_csp_;
+
   base::WeakPtrFactory<NavigationHandleImpl> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(NavigationHandleImpl);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_FRAME_HOST_NAVIGATION_HANDLE_IMPL_H_