PlzNavigate: Enforce 'frame-src' CSP on the browser.

third_party/WebKit/Source/web/WebLocalFrameImpl.cpp

Index: third_party/WebKit/Source/web/WebLocalFrameImpl.cpp
diff --git a/third_party/WebKit/Source/web/WebLocalFrameImpl.cpp b/third_party/WebKit/Source/web/WebLocalFrameImpl.cpp
index 859ed9967d4c420907b7b2fb2ce70167129e7875..b7029760a8330385cdfb48abc9ef6f1781870144 100644
--- a/third_party/WebKit/Source/web/WebLocalFrameImpl.cpp
+++ b/third_party/WebKit/Source/web/WebLocalFrameImpl.cpp
@@ -2044,6 +2044,27 @@ bool WebLocalFrameImpl::maybeRenderFallbackContent(
   return true;
 }
 
+// Called when a navigation is blocked because a Content Security Policy (CSP)
+// is infringed.
+void WebLocalFrameImpl::contentSecurityPolicyViolation(
+    const blink::WebContentSecurityPolicyViolation& violation) {
+  DCHECK(frame() && frame()->document());
+  Document* document = frame()->document();
+  Vector<String> reportEndpoints;
+  for (const WebString& endPoint : violation.reportEndpoints)
+    reportEndpoints.push_back(endPoint);
+  document->contentSecurityPolicy()->reportViolation(
+      violation.directive, /* directiveText */
+      ContentSecurityPolicy::getDirectiveType(
+          violation.effectiveDirective), /* effectiveType */
+      violation.consoleMessage,          /* consoleMessage */
+      violation.blockedUrl,              /* blockedUrl */
+      reportEndpoints,                   /* reportEndpoints */
+      violation.header,                  /* header */
+      static_cast<ContentSecurityPolicyHeaderType>(violation.disposition),
+      ContentSecurityPolicy::ViolationType::URLViolation); /* ViolationType */

[alexmos, 2017/02/10 22:59:54]

Do you need to forward the redirect status also, rather than relying on the
default?  

What about contextLine?  I saw you filed https://crbug.com/690946, but what
would it take to fix it?

Also, are we sure that violation type is always going to be
ContentSecurityPolicy::URLViolation?

[arthursonzogni, 2017/02/13 16:33:21]

Yes, I completely ignored the redirect status. Thanks! I need to fix it.
I don't know, it could be as easy as adding one more attribute to the navigation
params.
Yes, the violation type is always going to be a
ContentSecurityPolicy::URLViolation. The other choices are:
InlineViolation and EvalViolation.
As far as it is used only in PlzNavigate, it will be for blocking a navigation.

+}
+
 bool WebLocalFrameImpl::isLoading() const {
   if (!frame() || !frame()->document())
     return false;