PlzNavigate: Enforce 'frame-src' CSP on the browser.

content/common/navigation_params.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_COMMON_NAVIGATION_PARAMS_H_
 #define CONTENT_COMMON_NAVIGATION_PARAMS_H_
 
 #include <stdint.h>
 
 #include <map>
@@ skipping 40 matching lines @@
       FrameMsg_Navigate_Type::Value navigation_type,
       bool allow_download,
       bool should_replace_current_entry,
       base::TimeTicks ui_timestamp,
       FrameMsg_UILoadMetricsReportType::Value report_type,
       const GURL& base_url_for_data_url,
       const GURL& history_url_for_data_url,
       PreviewsState previews_state,
       const base::TimeTicks& navigation_start,
       std::string method,
-      const scoped_refptr<ResourceRequestBodyImpl>& post_data);
+      const scoped_refptr<ResourceRequestBodyImpl>& post_data,
+      bool should_bypass_main_world_csp);
   CommonNavigationParams(const CommonNavigationParams& other);
   ~CommonNavigationParams();
 
   // The URL to navigate to.
   // PlzNavigate: May be modified when the navigation is ready to commit.
   GURL url;
 
   // The URL to send in the "Referer" header field. Can be empty if there is
   // no referrer.
   Referrer referrer;
@@ skipping 40 matching lines @@
   // navigation_start value in Blink.
   // PlzNavigate: For renderer initiated navigations, this will be set on the
   // renderer side and sent with FrameHostMsg_BeginNavigation.
   base::TimeTicks navigation_start;
 
   // The request method: GET, POST, etc.
   std::string method;
 
   // Body of HTTP POST request.
   scoped_refptr<ResourceRequestBodyImpl> post_data;
+
+  // Returns true if the navigation was initiated from an isolated world. An
+  // isolated world has its own Content Security Policy. In this case, the
+  // policy of the main world should be ignored when evaluating resources
+  // injected into the DOM.
+  bool should_bypass_main_world_csp;

[nasko, 2017/02/15 21:28:44]

nit: Shouldn't we name the variable based on what it actually means instead of
on what the desired effect of it is? If it indicates that this was initiated in
an isolated world, then "is_initiated_from_isolated_world" seems more
appropriate. The code checking the variable later can make a decision whether to
bypass the CSP of main world or not.

[arthursonzogni, 2017/02/16 17:32:41]

I agree.

Edit: I don't know, I am using the same name as where I found this value:
FrameLoadRequest:shouldCheckMainWorldContentSecurityPolicy()

I would have to check that it really mean that the request was issued from an
isolated world and it doesn't depend on any other thing. And also updating all
these things in blink.

 };
 
 // Provided by the renderer ----------------------------------------------------
 //
 // This struct holds parameters sent by the renderer to the browser. It is only
 // used in PlzNavigate (since in the current architecture, the renderer does not
 // inform the browser of navigations until they commit).
 
 // This struct is not used outside of the PlzNavigate project.
 // PlzNavigate: parameters needed to start a navigation on the IO thread,
@@ skipping 221 matching lines @@
   ~NavigationParams();
 
   CommonNavigationParams common_params;
   StartNavigationParams start_params;
   RequestNavigationParams request_params;
 };
 
 }  // namespace content
 
 #endif  // CONTENT_COMMON_NAVIGATION_PARAMS_H_