PlzNavigate: Enforce frame-src CSP on the browser.

content/browser/frame_host/render_frame_host_impl.h

Index: content/browser/frame_host/render_frame_host_impl.h
diff --git a/content/browser/frame_host/render_frame_host_impl.h b/content/browser/frame_host/render_frame_host_impl.h
index 74ee70b1b2541002d192b8df3fbf34ed5a768c1a..5c7eb960a15de6cfa3520e544decec35a4553251 100644
--- a/content/browser/frame_host/render_frame_host_impl.h
+++ b/content/browser/frame_host/render_frame_host_impl.h
@@ -30,7 +30,7 @@
 #include "content/common/accessibility_mode_enums.h"
 #include "content/common/ax_content_node_data.h"
 #include "content/common/content_export.h"
-#include "content/common/content_security_policy/content_security_policy.h"
+#include "content/common/content_security_policy/csp_context.h"
 #include "content/common/download/mhtml_save_status.h"
 #include "content/common/frame.mojom.h"
 #include "content/common/frame_message_enums.h"
@@ -115,7 +115,8 @@ class CONTENT_EXPORT RenderFrameHostImpl
       public BrowserAccessibilityDelegate,
       public SiteInstanceImpl::Observer,
       public NON_EXPORTED_BASE(
-          service_manager::InterfaceFactory<media::mojom::InterfaceFactory>) {
+          service_manager::InterfaceFactory<media::mojom::InterfaceFactory>),
+      public CSPContext {
  public:
   using AXTreeSnapshotCallback =
       base::Callback<void(
@@ -208,6 +209,12 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // SiteInstanceImpl::Observer
   void RenderProcessGone(SiteInstanceImpl* site_instance) override;
 
+  // CSPContext
+  void LogToConsole(const std::string& message) override;
+  void ReportContentSecurityPolicyViolation(
+      const CSPViolationParams& violation_params) override;
+  bool SchemeShouldBypassCSP(const base::StringPiece& scheme) override;
+
   // Creates a RenderFrame in the renderer process.
   bool CreateRenderFrame(int proxy_routing_id,
                          int opener_routing_id,
@@ -269,6 +276,7 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // Update this frame's last committed origin.
   void set_last_committed_origin(const url::Origin& origin) {
     last_committed_origin_ = origin;
+    CSPContext::SetSelf(origin);

[nasko, 2017/03/03 23:04:23]

Calling this here means that this method is no longer simple setter. It should
be changed to CamelCased method in the cc file.

[arthursonzogni, 2017/03/06 15:10:12]

Done.

   }
 
   // Returns the associated WebUI or null if none applies.