PlzNavigate: Enforce 'frame-src' CSP on the browser.

content/browser/frame_host/frame_tree_node.h

Index: content/browser/frame_host/frame_tree_node.h
diff --git a/content/browser/frame_host/frame_tree_node.h b/content/browser/frame_host/frame_tree_node.h
index edb1033140aeb2b5cc1bd089bf67661f0a3e7a27..65a22e8290b03dd4a72ffd08c888343bf00df719 100644
--- a/content/browser/frame_host/frame_tree_node.h
+++ b/content/browser/frame_host/frame_tree_node.h
@@ -17,7 +17,7 @@
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/frame_host/render_frame_host_manager.h"
 #include "content/common/content_export.h"
-#include "content/common/content_security_policy/csp_policy.h"
+#include "content/common/content_security_policy/csp_context.h"
 #include "content/common/frame_owner_properties.h"
 #include "content/common/frame_replication_state.h"
 #include "third_party/WebKit/public/platform/WebInsecureRequestPolicy.h"
@@ -178,6 +178,12 @@ class CONTENT_EXPORT FrameTreeNode {
   // new document comes with a fresh set of CSP http headers).
   void ResetContentSecurityPolicy();
 
+  const std::vector<CSPPolicy>& csp_policies() const { return csp_policies_; }

[nasko, 2017/02/15 21:28:44]

nit: I would move this higher in the file with all the other simple accessors.

[arthursonzogni, 2017/02/16 17:32:41]

Done.

+
+  // Return the Content-Security-Policy context associated to this frame.

[nasko, 2017/02/15 21:28:44]

nit: "associated with"

+  // Never null.
+  CSPContext* csp_context() { return csp_context_.get(); }
+
   // Sets the current insecure request policy, and notifies proxies about the
   // update.
   void SetInsecureRequestPolicy(blink::WebInsecureRequestPolicy policy);
@@ -403,9 +409,13 @@ class CONTENT_EXPORT FrameTreeNode {
   // to the core logic of FrameTreeNode.
   FrameTreeNodeBlameContext blame_context_;
 
-  // A set of Content-Security-Policies to enforce on the browser-side.
+  // A set of Content-Security-Policy policies to enforce on the browser-side.
   std::vector<CSPPolicy> csp_policies_;
 
+  // Used to check if a frame is allowed to navigate to an URL according to a
+  // set of content-security-policy policies.
+  std::unique_ptr<CSPContext> csp_context_;

[nasko, 2017/02/15 21:28:44]

What is the difference between a context and a policy?

[arthursonzogni, 2017/02/16 17:32:41]

Please see my response above.

+
   DISALLOW_COPY_AND_ASSIGN(FrameTreeNode);
 };