Share schemes needed for CSP between the browser and the renderer.

url/url_util.h

Index: url/url_util.h
diff --git a/url/url_util.h b/url/url_util.h
index e424c503757edbf2002f081bb2cc8499ffaebcd1..ebeebfba736de8b2d4418ebafd3e54153c1d074b 100644
--- a/url/url_util.h
+++ b/url/url_util.h
@@ -98,6 +98,11 @@ URL_EXPORT const std::vector<std::string>& GetNoAccessSchemes();
 URL_EXPORT void AddCORSEnabledScheme(const char* new_scheme);
 URL_EXPORT const std::vector<std::string>& GetCORSEnabledSchemes();
 
+// Adds an application-defined scheme to the list of schemes that can bypass the
+// Content-Security-Policy(CSP) checks.
+URL_EXPORT void AddBypassingCSPScheme(const char* new_scheme);
+URL_EXPORT const std::vector<std::string>& GetBypassingCSPSchemes();

[Mike West, 2017/02/08 14:59:53]

I'm pretty hard-pressed to call this a concept that //url should know about.

+
 // Sets a flag to prevent future calls to Add*Scheme from succeeding.
 //
 // This is designed to help prevent errors for multithreaded applications.