PlzNavigate: Enforce 'frame-src' CSP on the browser.

content/public/browser/navigation_handle.h

Index: content/public/browser/navigation_handle.h
diff --git a/content/public/browser/navigation_handle.h b/content/public/browser/navigation_handle.h
index 0f3892c7015bb271d10eb5716dbc3c3aad61d274..841b63990c52243b583fb9df626cc0a4412b4e56 100644
--- a/content/public/browser/navigation_handle.h
+++ b/content/public/browser/navigation_handle.h
@@ -278,6 +278,11 @@ class CONTENT_EXPORT NavigationHandle {
   // ResourceDispatcherHostDelegate::GetNavigationData during commit. This will
   // be a clone of the NavigationData.
   virtual NavigationData* GetNavigationData() = 0;
+
+  // Whether or not the navigation has been issued by a content script or an
+  // isolated world, for instance from a chrome-extension. When true, the
+  // navigation should not be blocked by the parent frame's CSP.
+  virtual bool should_bypass_main_world_csp() const = 0;

[nasko, 2017/02/15 21:28:44]

Why is this method on the public interface? I don't see any code outside of
content/ using it.

[arthursonzogni, 2017/02/16 17:32:41]

You are right.

 };
 
 }  // namespace content