PlzNavigate: Enforce 'form-action' CSP on the browser-side.

content/browser/frame_host/form_submission_throttle.h

Index: content/browser/frame_host/form_submission_throttle.h
diff --git a/content/browser/frame_host/form_submission_throttle.h b/content/browser/frame_host/form_submission_throttle.h
new file mode 100644
index 0000000000000000000000000000000000000000..d8961092b210ac3f14152e818f16b81013dbcf12
--- /dev/null
+++ b/content/browser/frame_host/form_submission_throttle.h
@@ -0,0 +1,39 @@
+// Copyright 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_FRAME_HOST_FORM_SUBMISSION_THROTTLE_H_
+#define CONTENT_BROWSER_FRAME_HOST_FORM_SUBMISSION_THROTTLE_H_
+
+#include <memory>
+#include <string>
+
+#include "base/macros.h"
+#include "content/public/browser/navigation_throttle.h"
+
+namespace content {
+class NavigationHandle;
+
+// A FormSubmittionThrottle is responsible for enforcing the 'form-action' CSP,
+// blocking requests which violate them.
+class CONTENT_EXPORT FormSubmissionThrottle : public NavigationThrottle {

[Mike West, 2017/02/22 15:36:08]

Do you plan on creating a distinct throttle for `frame-src`/`child-src`
enforcement? I have no idea how much a throttle costs in terms of memory or
performance, so I'll defer to //content/OWNERS for the technical discussion, but
it seems to me that it might make more sense to define a single throtle for all
of CSP. *shrug*

[arthursonzogni, 2017/02/22 17:15:23]

I am okay with this idea.
The throttle is only created when there is a form submission though and I don't
think the NavigationThrottles have an huge impact(But I don't really know)

Do you want to merge the AncestorThrottle and the FormSubmissionThrottle into a
ContentSecurityPolicyThrottle?(Even if XFO is not really a CSP)?

[alexmos, 2017/02/28 02:48:46]

I'm personally ok either way.  Unifying them in one throttle will centralize all
the policies,  but I'm also not too worried about FormSubmissionThrottle's
overhead, since it's gated on the is_form_submission() bit, so you'd need it
very infrequently.  The ancestor throttle is currently created only for
subframes, whereas this matters for main frames too, so unifying them might also
get confusing in terms of when the throttle gets created.

[arthursonzogni, 2017/03/07 16:25:51]

Yes, nice summary.
What to decide for now? I would prefer keeping the two throttles if there is no
preference.

[nasko, 2017/03/09 05:35:16]

I would prefer separate ones, unless we have clear data about overhead. Code
simplicity and discoverability is key.

+ public:
+  static std::unique_ptr<NavigationThrottle> MaybeCreateThrottleFor(
+      NavigationHandle* handle);
+
+  ~FormSubmissionThrottle() override;
+
+  NavigationThrottle::ThrottleCheckResult WillStartRequest() override;
+  NavigationThrottle::ThrottleCheckResult WillRedirectRequest() override;
+
+ private:
+  explicit FormSubmissionThrottle(NavigationHandle* handle);
+  NavigationThrottle::ThrottleCheckResult CheckContentSecurityPolicyFormAction(
+      bool is_redirect);
+
+  DISALLOW_COPY_AND_ASSIGN(FormSubmissionThrottle);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_FRAME_HOST_FORM_SUBMISSION_THROTTLE_H_