PlzNavigate: Enforce 'frame-src' CSP on the browser.

content/browser/frame_host/navigation_handle_impl.h

Index: content/browser/frame_host/navigation_handle_impl.h
diff --git a/content/browser/frame_host/navigation_handle_impl.h b/content/browser/frame_host/navigation_handle_impl.h
index 3a460592222cbb92be3cf6bd10c8fc36d129ff6e..f9f09990851afbc82e16361c74a22458859484e6 100644
--- a/content/browser/frame_host/navigation_handle_impl.h
+++ b/content/browser/frame_host/navigation_handle_impl.h
@@ -91,7 +91,8 @@ class CONTENT_EXPORT NavigationHandleImpl : public NavigationHandle {
       bool is_same_page,
       const base::TimeTicks& navigation_start,
       int pending_nav_entry_id,
-      bool started_from_context_menu);
+      bool started_from_context_menu,
+      bool should_bypass_main_world_csp);
   ~NavigationHandleImpl() override;
 
   // NavigationHandle implementation:
@@ -148,6 +149,7 @@ class CONTENT_EXPORT NavigationHandleImpl : public NavigationHandle {
   const GlobalRequestID& GetGlobalRequestID() override;
 
   NavigationData* GetNavigationData() override;
+  bool should_bypass_main_world_csp() const override;
 
   // The NavigatorDelegate to notify/query for various navigation events.
   // Normally this is the WebContents, except if this NavigationHandle was
@@ -351,7 +353,8 @@ class CONTENT_EXPORT NavigationHandleImpl : public NavigationHandle {
                        bool is_same_page,
                        const base::TimeTicks& navigation_start,
                        int pending_nav_entry_id,
-                       bool started_from_context_menu);
+                       bool started_from_context_menu,
+                       bool should_bypass_main_world_csp);
 
   NavigationThrottle::ThrottleCheckResult CheckWillStartRequest();
   NavigationThrottle::ThrottleCheckResult CheckWillRedirectRequest();
@@ -490,6 +493,11 @@ class CONTENT_EXPORT NavigationHandleImpl : public NavigationHandle {
   net::HostPortPair socket_address_;
   NavigationType navigation_type_;
 
+  // Whether or not the navigation has been issued by a content script or an

[nasko, 2017/02/15 21:28:44]

nit: content script is an extensions system detail that probably doesn't belong
in content/. What matters is whether it was issued by an isolated world, which
is the web platform concept we should be using.

[arthursonzogni, 2017/02/16 17:32:41]

Okay, I don't know exactly know what is a content script. I added this comment
on alexmos@ suggestion.

+  // isolated world, for instance from a chrome extension. When true, the
+  // navigation should not be blocked by the parent frame's CSP.
+  bool should_bypass_main_world_csp_;
+
   base::WeakPtrFactory<NavigationHandleImpl> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(NavigationHandleImpl);