PlzNavigate: Enforce 'frame-src' CSP on the browser.

content/renderer/render_frame_impl.cc

Index: content/renderer/render_frame_impl.cc
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index 484c121cc1a39f246ff70bedbc639b2d98c5837a..1e11ffa02731a01443ac74c52b4a09955aa5e8a4 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -664,7 +664,8 @@ CommonNavigationParams MakeCommonNavigationParams(
       report_type, GURL(), GURL(),
       static_cast<PreviewsState>(info.urlRequest.getPreviewsState()),
       base::TimeTicks::Now(), info.urlRequest.httpMethod().latin1(),
-      GetRequestBodyForWebURLRequest(info.urlRequest));
+      GetRequestBodyForWebURLRequest(info.urlRequest),
+      info.shouldBypassMainWorldCSP);
 }
 
 media::Context3D GetSharedMainThreadContext3D(
@@ -1552,6 +1553,8 @@ bool RenderFrameImpl::OnMessageReceived(const IPC::Message& msg) {
                         OnTextTrackSettingsChanged)
     IPC_MESSAGE_HANDLER(FrameMsg_PostMessageEvent, OnPostMessageEvent)
     IPC_MESSAGE_HANDLER(FrameMsg_FailedNavigation, OnFailedNavigation)
+    IPC_MESSAGE_HANDLER(FrameMsg_ContentSecurityPolicyViolation,
+                        OnContentSecurityPolicyViolation)
     IPC_MESSAGE_HANDLER(FrameMsg_GetSavableResourceLinks,
                         OnGetSavableResourceLinks)
     IPC_MESSAGE_HANDLER(FrameMsg_GetSerializedHtmlWithLocalLinks,
@@ -5223,6 +5226,25 @@ void RenderFrameImpl::OnFailedNavigation(
   browser_side_navigation_pending_ = false;
 }
 
+void RenderFrameImpl::OnContentSecurityPolicyViolation(
+    const content::CSPViolationParams& violation_params) {
+  blink::WebContentSecurityPolicyViolation violation;
+  violation.directive = WebString::fromASCII(violation_params.directive);
+  violation.effectiveDirective =
+      WebString::fromASCII(violation_params.effective_directive);
+  violation.consoleMessage =
+      WebString::fromASCII(violation_params.console_message);
+  violation.blockedUrl = violation_params.blocked_url;
+  violation.reportEndpoints =
+      WebVector<WebString>(violation_params.report_endpoints.size());
+  for (size_t i = 0; i < violation_params.report_endpoints.size(); ++i)
+    violation.reportEndpoints[i] =
+        WebString::fromASCII(violation_params.report_endpoints[i]);
+  violation.header = WebString::fromASCII(violation_params.header);
+  violation.disposition = violation_params.disposition;
+  frame_->contentSecurityPolicyViolation(violation);
+}
+
 WebNavigationPolicy RenderFrameImpl::decidePolicyForNavigation(
     const NavigationPolicyInfo& info) {
   // A content initiated navigation may have originated from a link-click,