PlzNavigate: Enforce 'frame-src' CSP on the browser.

content/browser/frame_host/navigation_handle_impl.h

Index: content/browser/frame_host/navigation_handle_impl.h
diff --git a/content/browser/frame_host/navigation_handle_impl.h b/content/browser/frame_host/navigation_handle_impl.h
index 3a460592222cbb92be3cf6bd10c8fc36d129ff6e..e8a3a3a9588fb94dbe3b04fe166899cceccdd775 100644
--- a/content/browser/frame_host/navigation_handle_impl.h
+++ b/content/browser/frame_host/navigation_handle_impl.h
@@ -91,7 +91,8 @@ class CONTENT_EXPORT NavigationHandleImpl : public NavigationHandle {
       bool is_same_page,
       const base::TimeTicks& navigation_start,
       int pending_nav_entry_id,
-      bool started_from_context_menu);
+      bool started_from_context_menu,
+      bool should_bypass_main_world_csp);
   ~NavigationHandleImpl() override;
 
   // NavigationHandle implementation:
@@ -148,6 +149,7 @@ class CONTENT_EXPORT NavigationHandleImpl : public NavigationHandle {
   const GlobalRequestID& GetGlobalRequestID() override;
 
   NavigationData* GetNavigationData() override;
+  bool ShouldBypassMainWorldCSP() const override;
 
   // The NavigatorDelegate to notify/query for various navigation events.
   // Normally this is the WebContents, except if this NavigationHandle was
@@ -351,7 +353,8 @@ class CONTENT_EXPORT NavigationHandleImpl : public NavigationHandle {
                        bool is_same_page,
                        const base::TimeTicks& navigation_start,
                        int pending_nav_entry_id,
-                       bool started_from_context_menu);
+                       bool started_from_context_menu,
+                       bool should_bypass_main_world_csp);
 
   NavigationThrottle::ThrottleCheckResult CheckWillStartRequest();
   NavigationThrottle::ThrottleCheckResult CheckWillRedirectRequest();
@@ -490,6 +493,11 @@ class CONTENT_EXPORT NavigationHandleImpl : public NavigationHandle {
   net::HostPortPair socket_address_;
   NavigationType navigation_type_;
 
+  // Whether or not the navigation has been issued by an isolated world. For
+  // instance from a chrome extension. When it returns true, the navigation

[alexmos, 2017/02/14 06:57:20]

nit: I'd also mention content scripts, and make it into a complete sentence (or
combine with previous one).  Also, "When it returns true," -> "When true,"
(nothing returned here).  Perhaps something like:  "Whether or not the
navigation has been started from an isolated world, such as from an extension
content script.  When true, the navigation should not be blocked by the parent
frame's CSP."

[arthursonzogni, 2017/02/15 09:26:09]

Done.

+  // should not be blocked by the parent frame's Content-Security-Policy(CSP).

[alexmos, 2017/02/14 06:57:20]

nit: probably mentioning one of Content Security Policy or CSP is enough.

[arthursonzogni, 2017/02/15 09:26:09]

Done.

+  bool should_bypass_main_world_csp_;
+
   base::WeakPtrFactory<NavigationHandleImpl> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(NavigationHandleImpl);