PlzNavigate: Enforce 'frame-src' CSP on the browser.

content/common/navigation_params.h

Index: content/common/navigation_params.h
diff --git a/content/common/navigation_params.h b/content/common/navigation_params.h
index c47da6b89c797ca8ceb40b93f578effdf10bbe92..ade049004106ca661de03aa1e2b7a3940414e3e7 100644
--- a/content/common/navigation_params.h
+++ b/content/common/navigation_params.h
@@ -58,7 +58,8 @@ struct CONTENT_EXPORT CommonNavigationParams {
       PreviewsState previews_state,
       const base::TimeTicks& navigation_start,
       std::string method,
-      const scoped_refptr<ResourceRequestBodyImpl>& post_data);
+      const scoped_refptr<ResourceRequestBodyImpl>& post_data,
+      bool should_bypass_main_world_csp);
   CommonNavigationParams(const CommonNavigationParams& other);
   ~CommonNavigationParams();
 
@@ -119,6 +120,12 @@ struct CONTENT_EXPORT CommonNavigationParams {
 
   // Body of HTTP POST request.
   scoped_refptr<ResourceRequestBodyImpl> post_data;
+
+  // Returns true if the navigation was initiated from an isolated world. An
+  // isolated world has its own Content Security Policy. In this case, the
+  // policy of the main world should be ignored when evaluating resources
+  // injected into the DOM.
+  bool should_bypass_main_world_csp;

[nasko, 2017/02/15 21:28:44]

nit: Shouldn't we name the variable based on what it actually means instead of
on what the desired effect of it is? If it indicates that this was initiated in
an isolated world, then "is_initiated_from_isolated_world" seems more
appropriate. The code checking the variable later can make a decision whether to
bypass the CSP of main world or not.

[arthursonzogni, 2017/02/16 17:32:41]

I agree.

Edit: I don't know, I am using the same name as where I found this value:
FrameLoadRequest:shouldCheckMainWorldContentSecurityPolicy()

I would have to check that it really mean that the request was issued from an
isolated world and it doesn't depend on any other thing. And also updating all
these things in blink.

 };
 
 // Provided by the renderer ----------------------------------------------------