CSP: group policies in didAddContentSecurityPolicy.

content/renderer/render_frame_proxy.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_proxy.h"
 
 #include <stdint.h>
 #include <map>
 #include <utility>
 
@@ skipping 213 matching lines @@
   web_frame_->setReplicatedName(blink::WebString::fromUTF8(state.name));
   web_frame_->setReplicatedInsecureRequestPolicy(state.insecure_request_policy);
   web_frame_->setReplicatedPotentiallyTrustworthyUniqueOrigin(
       state.has_potentially_trustworthy_unique_origin);
   web_frame_->setReplicatedFeaturePolicyHeader(
       FeaturePolicyHeaderToWeb(state.feature_policy_header));
   if (state.has_received_user_gesture)
     web_frame_->setHasReceivedUserGesture();
 
   web_frame_->resetReplicatedContentSecurityPolicy();
-  for (const auto& header : state.accumulated_csp_headers)
-    OnAddContentSecurityPolicy(header);
+  OnAddContentSecurityPolicies(state.accumulated_csp_headers);
 }
 
 // Update the proxy's SecurityContext and FrameOwner with new sandbox flags
 // that were set by its parent in another process.
 //
 // Normally, when a frame's sandbox attribute is changed dynamically, the
 // frame's FrameOwner is updated with the new sandbox flags right away, while
 // the frame's SecurityContext is updated when the frame is navigated and the
 // new sandbox flags take effect.
 //
@@ skipping 23 matching lines @@
   IPC_BEGIN_MESSAGE_MAP(RenderFrameProxy, msg)
     IPC_MESSAGE_HANDLER(FrameMsg_DeleteProxy, OnDeleteProxy)
     IPC_MESSAGE_HANDLER(FrameMsg_ChildFrameProcessGone, OnChildFrameProcessGone)
     IPC_MESSAGE_HANDLER(FrameMsg_SetChildFrameSurface, OnSetChildFrameSurface)
     IPC_MESSAGE_HANDLER(FrameMsg_UpdateOpener, OnUpdateOpener)
     IPC_MESSAGE_HANDLER(FrameMsg_DidStartLoading, OnDidStartLoading)
     IPC_MESSAGE_HANDLER(FrameMsg_DidStopLoading, OnDidStopLoading)
     IPC_MESSAGE_HANDLER(FrameMsg_DidUpdateSandboxFlags, OnDidUpdateSandboxFlags)
     IPC_MESSAGE_HANDLER(FrameMsg_DispatchLoad, OnDispatchLoad)
     IPC_MESSAGE_HANDLER(FrameMsg_DidUpdateName, OnDidUpdateName)
-    IPC_MESSAGE_HANDLER(FrameMsg_AddContentSecurityPolicy,
-                        OnAddContentSecurityPolicy)
+    IPC_MESSAGE_HANDLER(FrameMsg_AddContentSecurityPolicies,
+                        OnAddContentSecurityPolicies)
     IPC_MESSAGE_HANDLER(FrameMsg_ResetContentSecurityPolicy,
                         OnResetContentSecurityPolicy)
     IPC_MESSAGE_HANDLER(FrameMsg_EnforceInsecureRequestPolicy,
                         OnEnforceInsecureRequestPolicy)
     IPC_MESSAGE_HANDLER(FrameMsg_SetFrameOwnerProperties,
                         OnSetFrameOwnerProperties)
     IPC_MESSAGE_HANDLER(FrameMsg_DidUpdateOrigin, OnDidUpdateOrigin)
     IPC_MESSAGE_HANDLER(InputMsg_SetFocus, OnSetPageFocus)
     IPC_MESSAGE_HANDLER(FrameMsg_SetFocusedFrame, OnSetFocusedFrame)
     IPC_MESSAGE_HANDLER(FrameMsg_WillEnterFullscreen, OnWillEnterFullscreen)
@@ skipping 53 matching lines @@
 void RenderFrameProxy::OnDispatchLoad() {
   web_frame_->dispatchLoadEventOnFrameOwner();
 }
 
 void RenderFrameProxy::OnDidUpdateName(const std::string& name,
                                        const std::string& unique_name) {
   web_frame_->setReplicatedName(blink::WebString::fromUTF8(name));
   unique_name_ = unique_name;
 }
 
-void RenderFrameProxy::OnAddContentSecurityPolicy(
-    const ContentSecurityPolicyHeader& header) {
-  web_frame_->addReplicatedContentSecurityPolicyHeader(
-      blink::WebString::fromUTF8(header.header_value), header.type,
-      header.source);
+void RenderFrameProxy::OnAddContentSecurityPolicies(
+    const std::vector<ContentSecurityPolicyHeader>& headers) {

[alexmos, 2017/03/25 01:46:27]

Is anything stopping us now from sending over the real policies to the proxies,
instead of reparsing policies from the headers?  That would be a nice cleanup to
do in a followup. 

[arthursonzogni, 2017/03/27 12:03:52]

We need this when PlzNavigate is disabled and OOPIF enabled. The browser-side
enforcement of the CSP works only with PlzNavigate.

I think that as soon as PlzNavigate is shipped, we will be able to remove the
replication of the CSP among the remote frame. That would be a nice cleanup.
Alternatively, it would be possible to enable the browser-side enforcement of
the CSP when PlzNavigate is disabled. FYI, I am currently blocked on making this
patch:
https://codereview.chromium.org/2698623006/
working without PlzNavigate.

[alexmos, 2017/03/27 18:27:22]

I agree we still need this for OOPIF without PlzNavigate, I was just thinking
whether FrameMsg_AddContentSecurityPolicies could pass not
ContentSecurityPolicyHeaders, but rather a vector of
content::ContentSecurityPolicy.  With the former, we end up reparsing the same
policy multiple times in each OOPIF renderer, and with the latter we'd avoid
that.  Back when we did the CSP header replication, we didn't have
content::ContentSecurityPolicy, but now we do.  But that'll probably involve
modifying FrameReplicationState as well, and you're probably right that it's
just easier to wait for PlzNavigate to ship and remove this altogether.

[arthursonzogni, 2017/03/28 11:12:21]

Yes, I think it would be possible to convert back the
content::ContentSecurityPolicy to the blink::CSPDirectiveList if we wanted to,
such that it isn't need to parse the header again.
I don't know. Let's say we will do nothing for the moment and wait for the CSP
replication not to be needed anymore and removed.

+  for (const auto& header : headers) {
+    web_frame_->addReplicatedContentSecurityPolicyHeader(
+        blink::WebString::fromUTF8(header.header_value), header.type,
+        header.source);
+  }
 }
 
 void RenderFrameProxy::OnResetContentSecurityPolicy() {
   web_frame_->resetReplicatedContentSecurityPolicy();
 }
 
 void RenderFrameProxy::OnEnforceInsecureRequestPolicy(
     blink::WebInsecureRequestPolicy policy) {
   web_frame_->setReplicatedInsecureRequestPolicy(policy);
 }
@@ skipping 158 matching lines @@
                                     blink::WebLocalFrame* source) {
   int source_routing_id = RenderFrameImpl::FromWebFrame(source)->GetRoutingID();
   Send(new FrameHostMsg_AdvanceFocus(routing_id_, type, source_routing_id));
 }
 
 void RenderFrameProxy::frameFocused() {
   Send(new FrameHostMsg_FrameFocused(routing_id_));
 }
 
 }  // namespace