Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(550)

Unified Diff: third_party/WebKit/Source/core/loader/FrameLoader.cpp

Issue 2655463006: PlzNavigate: Enforce 'frame-src' CSP on the browser. (Closed)
Patch Set: Rebase. Created 3 years, 9 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: third_party/WebKit/Source/core/loader/FrameLoader.cpp
diff --git a/third_party/WebKit/Source/core/loader/FrameLoader.cpp b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
index 8011ff126505feb44dd3b6a058acddd9bf8e391f..f5b8cec3ad254910ff5fef0ad3b96457ccc92fef 100644
--- a/third_party/WebKit/Source/core/loader/FrameLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/FrameLoader.cpp
@@ -1660,11 +1660,20 @@ NavigationPolicy FrameLoader::shouldContinueForNavigationPolicy(
if (request.url().isEmpty() || substituteData.isValid())
return NavigationPolicyCurrentTab;
+ Settings* settings = m_frame->settings();
+ bool browserSideNavigationEnabled =
+ settings && settings->getBrowserSideNavigationEnabled();
+
// If we're loading content into |m_frame| (NavigationPolicyCurrentTab), check
// against the parent's Content Security Policy and kill the load if that
// check fails, unless we should bypass the main world's CSP.
if (policy == NavigationPolicyCurrentTab &&
- shouldCheckMainWorldContentSecurityPolicy == CheckContentSecurityPolicy) {
+ shouldCheckMainWorldContentSecurityPolicy == CheckContentSecurityPolicy &&
+ // TODO(arthursonzogni): 'frame-src' check is disabled on the
+ // renderer side with browser-side-navigation, but is enforced on the
+ // browser side. See http://crbug.com/692595 for understanding why it
+ // can't be enforced on both sides instead.
+ !browserSideNavigationEnabled) {
Frame* parentFrame = m_frame->tree().parent();
if (parentFrame) {
ContentSecurityPolicy* parentPolicy =
@@ -1691,9 +1700,9 @@ NavigationPolicy FrameLoader::shouldContinueForNavigationPolicy(
bool replacesCurrentHistoryItem =
frameLoadType == FrameLoadTypeReplaceCurrentItem;
- policy = client()->decidePolicyForNavigation(request, loader, type, policy,
- replacesCurrentHistoryItem,
- isClientRedirect, form);
+ policy = client()->decidePolicyForNavigation(
+ request, loader, type, policy, replacesCurrentHistoryItem,
+ isClientRedirect, form, shouldCheckMainWorldContentSecurityPolicy);
if (policy == NavigationPolicyCurrentTab ||
policy == NavigationPolicyIgnore ||
policy == NavigationPolicyHandledByClient ||
« no previous file with comments | « third_party/WebKit/Source/core/loader/EmptyClients.cpp ('k') | third_party/WebKit/Source/web/LocalFrameClientImpl.h » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698