PlzNavigate: Enforce 'frame-src' CSP on the browser.

content/common/frame_messages.h

Index: content/common/frame_messages.h
diff --git a/content/common/frame_messages.h b/content/common/frame_messages.h
index 023494a36d6e168d991f4129d7d32df12797a85b..e104f8c4999fa66bf32b0823a624b28849d7e79a 100644
--- a/content/common/frame_messages.h
+++ b/content/common/frame_messages.h
@@ -19,7 +19,7 @@
 #include "cc/surfaces/surface_sequence.h"
 #include "content/common/content_export.h"
 #include "content/common/content_param_traits.h"
-#include "content/common/content_security_policy/content_security_policy.h"
+#include "content/common/content_security_policy/csp_context.h"
 #include "content/common/content_security_policy_header.h"
 #include "content/common/download/mhtml_save_status.h"
 #include "content/common/frame_message_enums.h"
@@ -342,6 +342,7 @@ IPC_STRUCT_TRAITS_BEGIN(content::CommonNavigationParams)
   IPC_STRUCT_TRAITS_MEMBER(navigation_start)
   IPC_STRUCT_TRAITS_MEMBER(method)
   IPC_STRUCT_TRAITS_MEMBER(post_data)
+  IPC_STRUCT_TRAITS_MEMBER(should_bypass_main_world_csp)

[ncarter (slow), 2017/03/13 18:44:29]

I'm wondering if we ought to consider making this be the url::Origin
corresponding to the SecurityOrigin of the isolated world in which the
navigation originated (or a null origin, if it's the main world)?

The FIXME here
https://cs.chromium.org/chromium/src/third_party/WebKit/public/web/WebFrame.h...
suggests that existing user scripts enjoy carte blanche when it comes to CSP
enforcement, and if so, it may be very very tough to ever actually lock this
down and actually apply the extension's CSP. Though maybe we could at least put
up a console warning when this happens, or some other gradual upgrade path.

If this were an origin instead of a bool, we could at least double check that it
corresponded to an extension that was supposed to run a user script in the page,
which maybe provides some protection. And it would provide a pathway to
potentially fixing the FIXME later.

[arthursonzogni, 2017/03/14 15:38:57]

I lack knowledge about isolated world. Okay, there is CSPs for extensions
too and they are not used for now. It seems to me that they are not even stored
in blink. Blink only knows that they are defined, but not what they are.

I was thinking about frame-src. In the future, if we were able to apply
the isolated world CSPs. Should we apply any extension's CSPs when the
request is initiated by an user-script for the frame-src case? I ask this
because frame-src doesn't use the CSP of the document that has initiated the
navigation, but the CSPs of the parent of the document that is navigating.

Does someone else want to say something?

[alexmos, 2017/03/17 00:24:27]

Our docs say that "content scripts are generally not subject to the CSP of the
extension", and additionally, "the CSP of the page does not apply to content
scripts".
https://developer.chrome.com/extensions/contentSecurityPolicy#interactions

Given that people have been building extensions under these expectations, it
seems hard to start enforcing any kind of CSP for content scripts.  Would the
extension needs to declare a separate CSP for content scripts, since the default
extension CSP applies to background pages and event pages, but here we'd need to
apply it to regular web pages?  I don't know if the FIXME is actually fixable.

I agree with Nick that having an origin here would at least let the browser
process verify that there's an extension with a content script that was supposed
to run on the page that sent this, to minimize malicious renderers misusing this
to bypass CSP.  Not much, but better than nothing.  However, given the amount of
plumbing involved, I'm ok not blocking this CL on it and exploring this in a
followup.  Perhaps you can file a bug to explore ways to lock down the use of
this flag so we don't forget?

[arthursonzogni, 2017/03/17 11:42:31]

TODO and BUG added: https://crbug.com/702540

 IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(content::BeginNavigationParams)
@@ -569,6 +570,17 @@ IPC_STRUCT_TRAITS_BEGIN(content::ContentSecurityPolicyHeader)
   IPC_STRUCT_TRAITS_MEMBER(source)
 IPC_STRUCT_TRAITS_END()
 
+IPC_STRUCT_TRAITS_BEGIN(content::CSPViolationParams)
+  IPC_STRUCT_TRAITS_MEMBER(directive)
+  IPC_STRUCT_TRAITS_MEMBER(effective_directive)
+  IPC_STRUCT_TRAITS_MEMBER(console_message)
+  IPC_STRUCT_TRAITS_MEMBER(blocked_url)
+  IPC_STRUCT_TRAITS_MEMBER(report_endpoints)
+  IPC_STRUCT_TRAITS_MEMBER(header)
+  IPC_STRUCT_TRAITS_MEMBER(disposition)
+  IPC_STRUCT_TRAITS_MEMBER(after_redirect)
+IPC_STRUCT_TRAITS_END()
+
 IPC_STRUCT_TRAITS_BEGIN(content::FileChooserFileInfo)
   IPC_STRUCT_TRAITS_MEMBER(file_path)
   IPC_STRUCT_TRAITS_MEMBER(display_name)
@@ -890,6 +902,12 @@ IPC_MESSAGE_ROUTED4(FrameMsg_FailedNavigation,
                     bool,                             /* stale_copy_in_cache */
                     int                               /* error_code */)
 
+// PlzNavigate
+// Tells the renderer that a navigation was blocked because a content security
+// policy was violated.
+IPC_MESSAGE_ROUTED1(FrameMsg_ReportContentSecurityPolicyViolation,
+                    content::CSPViolationParams /* violation_params */)
+
 // Request to enumerate and return links to all savable resources in the frame
 // Note: this covers only the immediate frame / doesn't cover subframes.
 IPC_MESSAGE_ROUTED0(FrameMsg_GetSavableResourceLinks)