PlzNavigate: Enforce 'frame-src' CSP on the browser.

third_party/WebKit/Source/core/frame/LocalFrameClient.h

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights
  * reserved.
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
@@ skipping 104 matching lines @@
   virtual void dispatchDidFinishLoad() = 0;
   virtual void dispatchDidChangeThemeColor() = 0;
 
   virtual NavigationPolicy decidePolicyForNavigation(
       const ResourceRequest&,
       DocumentLoader*,
       NavigationType,
       NavigationPolicy,
       bool shouldReplaceCurrentEntry,
       bool isClientRedirect,
-      HTMLFormElement*) = 0;
+      HTMLFormElement*,
+      ContentSecurityPolicyDisposition
+          shouldCheckMainWorldContentSecurityPolicy) = 0;

[dcheng, 2017/03/13 19:02:54]

Main world or main frame?

[ncarter (slow), 2017/03/13 21:18:53]

Main world is right. Isolated worlds (e.g. user scripts) bypass the CSP that
applies to the frame's main world. The CSP of the main frame may be a
contributing factor in determining the effective CSP for a frame's main world
but they are not the same.

 
   virtual void dispatchWillSendSubmitEvent(HTMLFormElement*) = 0;
   virtual void dispatchWillSubmitForm(HTMLFormElement*) = 0;
 
   virtual void didStartLoading(LoadStartType) = 0;
   virtual void progressEstimateChanged(double progressEstimate) = 0;
   virtual void didStopLoading() = 0;
 
   virtual void loadURLExternally(const ResourceRequest&,
                                  NavigationPolicy,
@@ skipping 205 matching lines @@
   virtual KURL overrideFlashEmbedWithHTML(const KURL&) { return KURL(); }
 
   virtual BlameContext* frameBlameContext() { return nullptr; }
 
   virtual void setHasReceivedUserGesture() {}
 };
 
 }  // namespace blink
 
 #endif  // LocalFrameClient_h