PlzNavigate: Enforce 'frame-src' CSP on the browser.

content/common/frame_messages.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // IPC messages for interacting with frames.
 // Multiply-included message file, hence no include guard.
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <map>
 #include <set>
 #include <string>
 #include <vector>
 
 #include "build/build_config.h"
 #include "cc/surfaces/surface_id.h"
 #include "cc/surfaces/surface_info.h"
 #include "cc/surfaces/surface_sequence.h"
 #include "content/common/content_export.h"
 #include "content/common/content_param_traits.h"
-#include "content/common/content_security_policy/content_security_policy.h"
+#include "content/common/content_security_policy/csp_context.h"
 #include "content/common/content_security_policy_header.h"
 #include "content/common/download/mhtml_save_status.h"
 #include "content/common/frame_message_enums.h"
 #include "content/common/frame_owner_properties.h"
 #include "content/common/frame_replication_state.h"
 #include "content/common/message_port.h"
 #include "content/common/navigation_gesture.h"
 #include "content/common/navigation_params.h"
 #include "content/common/savable_subframe.h"
 #include "content/public/common/color_suggestion.h"
@@ skipping 302 matching lines @@
   IPC_STRUCT_TRAITS_MEMBER(allow_download)
   IPC_STRUCT_TRAITS_MEMBER(should_replace_current_entry)
   IPC_STRUCT_TRAITS_MEMBER(ui_timestamp)
   IPC_STRUCT_TRAITS_MEMBER(report_type)
   IPC_STRUCT_TRAITS_MEMBER(base_url_for_data_url)
   IPC_STRUCT_TRAITS_MEMBER(history_url_for_data_url)
   IPC_STRUCT_TRAITS_MEMBER(previews_state)
   IPC_STRUCT_TRAITS_MEMBER(navigation_start)
   IPC_STRUCT_TRAITS_MEMBER(method)
   IPC_STRUCT_TRAITS_MEMBER(post_data)
+  IPC_STRUCT_TRAITS_MEMBER(should_bypass_main_world_csp)

[ncarter (slow), 2017/03/13 18:44:29]

I'm wondering if we ought to consider making this be the url::Origin
corresponding to the SecurityOrigin of the isolated world in which the
navigation originated (or a null origin, if it's the main world)?

The FIXME here
https://cs.chromium.org/chromium/src/third_party/WebKit/public/web/WebFrame.h...
suggests that existing user scripts enjoy carte blanche when it comes to CSP
enforcement, and if so, it may be very very tough to ever actually lock this
down and actually apply the extension's CSP. Though maybe we could at least put
up a console warning when this happens, or some other gradual upgrade path.

If this were an origin instead of a bool, we could at least double check that it
corresponded to an extension that was supposed to run a user script in the page,
which maybe provides some protection. And it would provide a pathway to
potentially fixing the FIXME later.

[arthursonzogni, 2017/03/14 15:38:57]

I lack knowledge about isolated world. Okay, there is CSPs for extensions
too and they are not used for now. It seems to me that they are not even stored
in blink. Blink only knows that they are defined, but not what they are.

I was thinking about frame-src. In the future, if we were able to apply
the isolated world CSPs. Should we apply any extension's CSPs when the
request is initiated by an user-script for the frame-src case? I ask this
because frame-src doesn't use the CSP of the document that has initiated the
navigation, but the CSPs of the parent of the document that is navigating.

Does someone else want to say something?

[alexmos, 2017/03/17 00:24:27]

Our docs say that "content scripts are generally not subject to the CSP of the
extension", and additionally, "the CSP of the page does not apply to content
scripts".
https://developer.chrome.com/extensions/contentSecurityPolicy#interactions

Given that people have been building extensions under these expectations, it
seems hard to start enforcing any kind of CSP for content scripts.  Would the
extension needs to declare a separate CSP for content scripts, since the default
extension CSP applies to background pages and event pages, but here we'd need to
apply it to regular web pages?  I don't know if the FIXME is actually fixable.

I agree with Nick that having an origin here would at least let the browser
process verify that there's an extension with a content script that was supposed
to run on the page that sent this, to minimize malicious renderers misusing this
to bypass CSP.  Not much, but better than nothing.  However, given the amount of
plumbing involved, I'm ok not blocking this CL on it and exploring this in a
followup.  Perhaps you can file a bug to explore ways to lock down the use of
this flag so we don't forget?

[arthursonzogni, 2017/03/17 11:42:31]

TODO and BUG added: https://crbug.com/702540

 IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(content::BeginNavigationParams)
   IPC_STRUCT_TRAITS_MEMBER(headers)
   IPC_STRUCT_TRAITS_MEMBER(load_flags)
   IPC_STRUCT_TRAITS_MEMBER(has_user_gesture)
   IPC_STRUCT_TRAITS_MEMBER(skip_service_worker)
   IPC_STRUCT_TRAITS_MEMBER(request_context_type)
   IPC_STRUCT_TRAITS_MEMBER(mixed_content_context_type)
   IPC_STRUCT_TRAITS_MEMBER(searchable_form_url)
@@ skipping 207 matching lines @@
   IPC_STRUCT_TRAITS_MEMBER(report_endpoints)
   IPC_STRUCT_TRAITS_MEMBER(header)
 IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(content::ContentSecurityPolicyHeader)
   IPC_STRUCT_TRAITS_MEMBER(header_value)
   IPC_STRUCT_TRAITS_MEMBER(type)
   IPC_STRUCT_TRAITS_MEMBER(source)
 IPC_STRUCT_TRAITS_END()
 
+IPC_STRUCT_TRAITS_BEGIN(content::CSPViolationParams)
+  IPC_STRUCT_TRAITS_MEMBER(directive)
+  IPC_STRUCT_TRAITS_MEMBER(effective_directive)
+  IPC_STRUCT_TRAITS_MEMBER(console_message)
+  IPC_STRUCT_TRAITS_MEMBER(blocked_url)
+  IPC_STRUCT_TRAITS_MEMBER(report_endpoints)
+  IPC_STRUCT_TRAITS_MEMBER(header)
+  IPC_STRUCT_TRAITS_MEMBER(disposition)
+  IPC_STRUCT_TRAITS_MEMBER(after_redirect)
+IPC_STRUCT_TRAITS_END()
+
 IPC_STRUCT_TRAITS_BEGIN(content::FileChooserFileInfo)
   IPC_STRUCT_TRAITS_MEMBER(file_path)
   IPC_STRUCT_TRAITS_MEMBER(display_name)
   IPC_STRUCT_TRAITS_MEMBER(file_system_url)
   IPC_STRUCT_TRAITS_MEMBER(modification_time)
   IPC_STRUCT_TRAITS_MEMBER(length)
   IPC_STRUCT_TRAITS_MEMBER(is_directory)
 IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(content::FileChooserParams)
@@ skipping 301 matching lines @@
 
 // PlzNavigate
 // Tells the renderer that a navigation failed with the error code |error_code|
 // and that the renderer should display an appropriate error page.
 IPC_MESSAGE_ROUTED4(FrameMsg_FailedNavigation,
                     content::CommonNavigationParams,  /* common_params */
                     content::RequestNavigationParams, /* request_params */
                     bool,                             /* stale_copy_in_cache */
                     int                               /* error_code */)
 
+// PlzNavigate
+// Tells the renderer that a navigation was blocked because a content security
+// policy was violated.
+IPC_MESSAGE_ROUTED1(FrameMsg_ReportContentSecurityPolicyViolation,
+                    content::CSPViolationParams /* violation_params */)
+
 // Request to enumerate and return links to all savable resources in the frame
 // Note: this covers only the immediate frame / doesn't cover subframes.
 IPC_MESSAGE_ROUTED0(FrameMsg_GetSavableResourceLinks)
 
 // Get html data by serializing the target frame and replacing all resource
 // links with a path to the local copy passed in the message payload.
 IPC_MESSAGE_ROUTED2(FrameMsg_GetSerializedHtmlWithLocalLinks,
                     FrameMsg_GetSerializedHtmlWithLocalLinks_UrlMap,
                     FrameMsg_GetSerializedHtmlWithLocalLinks_FrameRoutingIdMap)
 
@@ skipping 705 matching lines @@
 // nearest find result in the sending frame.
 IPC_MESSAGE_ROUTED2(FrameHostMsg_GetNearestFindResult_Reply,
                     int /* nfr_request_id */,
                     float /* distance */)
 #endif
 
 // Adding a new message? Stick to the sort order above: first platform
 // independent FrameMsg, then ifdefs for platform specific FrameMsg, then
 // platform independent FrameHostMsg, then ifdefs for platform specific
 // FrameHostMsg.