PlzNavigate: Enforce 'form-action' CSP on the browser-side.

content/browser/frame_host/navigation_request.cc

Index: content/browser/frame_host/navigation_request.cc
diff --git a/content/browser/frame_host/navigation_request.cc b/content/browser/frame_host/navigation_request.cc
index c1ab7f9ed7120385bf5620508da8dd1f200edb68..bf801e742b901ccdfac9dd55f2f8dd7ae9c1b270 100644
--- a/content/browser/frame_host/navigation_request.cc
+++ b/content/browser/frame_host/navigation_request.cc
@@ -221,6 +221,7 @@ std::unique_ptr<NavigationRequest> NavigationRequest::CreateBrowserInitiated(
                             false,  // skip_service_worker
                             REQUEST_CONTEXT_TYPE_LOCATION,
                             blink::WebMixedContentContextType::Blockable,
+                            false,  // is_form_submission

[nasko, 2017/03/16 21:49:47]

I know the browser pops up a dialog warning you if you refresh a form submission
navigation. Does reload go through this path or a different one? I guess if the
submission was allowed in the first place, the reload should be allowed too.
However semantically it might be incorrect to say that it isn't a form
submission.

[arthursonzogni, 2017/03/17 14:58:25]

You are right.

The current behavior is to check the CSP on form resubmission. I think it is
wrong since the CSPs of the previous document doesn't exist anymore. Instead it
uses the CSP of the current document which doesn't make sense to me.
It is probably better to allow every form resubmission since the navigation was
allowed in the first place.

I talk with @mkwst today. Not checking form-action on form resubmission is
probably the right thing to do. Nevertheless, care should be taken when the
current document is the error page.

I will add a TODO for the moment. I am working on storing is_form_submission
attribute close to the post_body.

                             initiator),
       entry.ConstructRequestNavigationParams(
           frame_entry, common_params.url, common_params.method,
@@ -401,7 +402,8 @@ void NavigationRequest::CreateNavigationHandle(int pending_nav_entry_id) {
                                    common_params_.navigation_start,
                                    pending_nav_entry_id,
                                    false,  // started_in_context_menu
-                                   common_params_.should_bypass_main_world_csp);
+                                   common_params_.should_bypass_main_world_csp,
+                                   begin_params_.is_form_submission);
 
   if (!frame_tree_node->navigation_request()) {
     // A callback could have cancelled this request synchronously in which case