PlzNavigate: Enforce 'frame-src' CSP on the browser.

third_party/WebKit/Source/core/frame/LocalFrameClient.h

Index: third_party/WebKit/Source/core/frame/LocalFrameClient.h
diff --git a/third_party/WebKit/Source/core/frame/LocalFrameClient.h b/third_party/WebKit/Source/core/frame/LocalFrameClient.h
index 3cf25b469e634e036e70c2f1fd913feea9b0a73e..fadb234ad93673c45f14a8aed4b318ff0b044bdb 100644
--- a/third_party/WebKit/Source/core/frame/LocalFrameClient.h
+++ b/third_party/WebKit/Source/core/frame/LocalFrameClient.h
@@ -122,7 +122,9 @@ class CORE_EXPORT LocalFrameClient : public FrameClient {
       NavigationPolicy,
       bool shouldReplaceCurrentEntry,
       bool isClientRedirect,
-      HTMLFormElement*) = 0;
+      HTMLFormElement*,
+      ContentSecurityPolicyDisposition
+          shouldCheckMainWorldContentSecurityPolicy) = 0;

[dcheng, 2017/03/13 19:02:54]

Main world or main frame?

[ncarter (slow), 2017/03/13 21:18:53]

Main world is right. Isolated worlds (e.g. user scripts) bypass the CSP that
applies to the frame's main world. The CSP of the main frame may be a
contributing factor in determining the effective CSP for a frame's main world
but they are not the same.

 
   virtual void dispatchWillSendSubmitEvent(HTMLFormElement*) = 0;
   virtual void dispatchWillSubmitForm(HTMLFormElement*) = 0;