PlzNavigate: Enforce 'form-action' CSP on the browser-side.

content/browser/frame_host/navigation_handle_impl.h

Index: content/browser/frame_host/navigation_handle_impl.h
diff --git a/content/browser/frame_host/navigation_handle_impl.h b/content/browser/frame_host/navigation_handle_impl.h
index 3bdc4fd36fd2b0c282e6220af03378bd1aaa90c1..fa3461f3a391744adb84fccdc42357bd8c621c23 100644
--- a/content/browser/frame_host/navigation_handle_impl.h
+++ b/content/browser/frame_host/navigation_handle_impl.h
@@ -93,7 +93,8 @@ class CONTENT_EXPORT NavigationHandleImpl : public NavigationHandle {
       const base::TimeTicks& navigation_start,
       int pending_nav_entry_id,
       bool started_from_context_menu,
-      bool should_bypass_main_world_csp);
+      bool should_bypass_main_world_csp,
+      bool is_form_submission);
   ~NavigationHandleImpl() override;
 
   // NavigationHandle implementation:
@@ -152,6 +153,10 @@ class CONTENT_EXPORT NavigationHandleImpl : public NavigationHandle {
 
   NavigationData* GetNavigationData() override;
 
+  // Whether or not the navigation has been initiated by a form submission. It
+  // is currently not available when PlzNavigate is disabled.

[alexmos, 2017/02/28 02:48:47]

I'll defer to clamy@ and nasko@ on whether this is ok to land with a DCHECK
without PlzNavigate.  Presumably, we could plumb this information without
PlzNavigate as well - is that in your plans?  If so, could you add a TODO?  

[arthursonzogni, 2017/03/07 16:25:51]

Yes, my plan was to eventually plumb this information without PlzNavigate as
well if we really need it. But I think that the old navigation architecture will
be removed before we might need it.
So, I think that no TODO is required here.

[nasko, 2017/03/09 05:35:17]

Adding a TODO and keeping it PlzNavigate specific is fine with me.

[arthursonzogni, 2017/03/10 09:35:37]

Okay, but please notice that I will have to remove
  DCHECK(IsBrowserSideNavigationEnabled())
      << "This method is implemented only with PlzNavigate";

Done.

+  bool is_form_submission() const;

[nasko, 2017/03/09 05:35:17]

Since this is a simple accessor, it should be inlined in the header.

[arthursonzogni, 2017/03/10 09:35:37]

Done.

+
   // The NavigatorDelegate to notify/query for various navigation events.
   // Normally this is the WebContents, except if this NavigationHandle was
   // created during a navigation to an interstitial page. In this case it will
@@ -359,7 +364,8 @@ class CONTENT_EXPORT NavigationHandleImpl : public NavigationHandle {
                        const base::TimeTicks& navigation_start,
                        int pending_nav_entry_id,
                        bool started_from_context_menu,
-                       bool should_bypass_main_world_csp);
+                       bool should_bypass_main_world_csp,
+                       bool is_form_submission);
 
   NavigationThrottle::ThrottleCheckResult CheckWillStartRequest();
   NavigationThrottle::ThrottleCheckResult CheckWillRedirectRequest();
@@ -511,6 +517,9 @@ class CONTENT_EXPORT NavigationHandleImpl : public NavigationHandle {
   // blocked by the parent frame's CSP.
   bool should_bypass_main_world_csp_;
 
+  // Whether or not the navigation results from the submission of a form.
+  bool is_form_submission_;
+
   base::WeakPtrFactory<NavigationHandleImpl> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(NavigationHandleImpl);