Added validation of the policy specified in the 'csp' attribute

third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp

 /*
  * Copyright (C) 2011 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 1691 matching lines @@
     SchemeRegistry::PolicyAreas area) {
   if (SecurityOrigin::ShouldUseInnerURL(url)) {
     return SchemeRegistry::SchemeShouldBypassContentSecurityPolicy(
         SecurityOrigin::ExtractInnerURL(url).Protocol(), area);
   } else {
     return SchemeRegistry::SchemeShouldBypassContentSecurityPolicy(
         url.Protocol(), area);
   }
 }
 
+// static
+bool ContentSecurityPolicy::IsValidCSPAttr(const String& attr) {
+  ContentSecurityPolicy* policy = ContentSecurityPolicy::Create();
+  policy->AddPolicyFromHeaderValue(attr,
+                                   kContentSecurityPolicyHeaderTypeEnforce,
+                                   kContentSecurityPolicyHeaderSourceHTTP);
+  if (policy->console_messages_.IsEmpty() && policy->policies_.size() == 1) {
+    return true;
+  }
+  return false;
+}
+
 }  // namespace blink