PlzNavigate: Enforce 'frame-src' CSP on the browser.

third_party/WebKit/Source/core/loader/FrameLoaderClient.h

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights
  * reserved.
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
@@ skipping 103 matching lines @@
   virtual void dispatchDidFinishLoad() = 0;
   virtual void dispatchDidChangeThemeColor() = 0;
 
   virtual NavigationPolicy decidePolicyForNavigation(
       const ResourceRequest&,
       DocumentLoader*,
       NavigationType,
       NavigationPolicy,
       bool shouldReplaceCurrentEntry,
       bool isClientRedirect,
-      HTMLFormElement*) = 0;
+      HTMLFormElement*,
+      ContentSecurityPolicyDisposition shouldBypassMainWorldCSP) = 0;

[alexmos, 2017/02/24 06:40:28]

This arg is named as if it's a bool, but it's not, and it sounds completely
different from the enum's name. :)  Perhaps just policyDisposition?  It's clear
enough what it is for when you check it against the enum value.  (or you could
actually pass this as a bool)

[arthursonzogni, 2017/02/24 16:13:30]

I agree. I will use shouldCheckMainWorldContentSecurityPolicy.

 
   virtual void dispatchWillSendSubmitEvent(HTMLFormElement*) = 0;
   virtual void dispatchWillSubmitForm(HTMLFormElement*) = 0;
 
   virtual void didStartLoading(LoadStartType) = 0;
   virtual void progressEstimateChanged(double progressEstimate) = 0;
   virtual void didStopLoading() = 0;
 
   virtual void loadURLExternally(const ResourceRequest&,
                                  NavigationPolicy,
@@ skipping 206 matching lines @@
   virtual KURL overrideFlashEmbedWithHTML(const KURL&) { return KURL(); }
 
   virtual BlameContext* frameBlameContext() { return nullptr; }
 
   virtual void setHasReceivedUserGesture() {}
 };
 
 }  // namespace blink
 
 #endif  // FrameLoaderClient_h