Added validation of the policy specified in the 'csp' attribute

third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.h

 /*
  * Copyright (C) 2011 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 414 matching lines @@
   // This method checks if if this policy subsumes a given policy.
   // Note the correct result is guaranteed if this policy contains only one
   // CSPDirectiveList. More information here:
   // https://w3c.github.io/webappsec-csp/embedded/#subsume-policy
   bool Subsumes(const ContentSecurityPolicy&) const;
 
   Document* GetDocument() const;
 
   bool HasHeaderDeliveredPolicy() const { return header_delivered_; }
 
+  static bool IsValidCSPAttr(const String& attr);
+
  private:
   FRIEND_TEST_ALL_PREFIXES(ContentSecurityPolicyTest, NonceInline);
   FRIEND_TEST_ALL_PREFIXES(ContentSecurityPolicyTest, NonceSinglePolicy);
   FRIEND_TEST_ALL_PREFIXES(ContentSecurityPolicyTest, NonceMultiplePolicy);
   FRIEND_TEST_ALL_PREFIXES(BaseFetchContextTest,
                            RedirectChecksReportedAndEnforcedCSP);
   FRIEND_TEST_ALL_PREFIXES(BaseFetchContextTest,
                            AllowResponseChecksReportedAndEnforcedCSP);
   FRIEND_TEST_ALL_PREFIXES(FrameFetchContextTest,
                            PopulateResourceRequestChecksReportOnlyCSP);
@@ skipping 38 matching lines @@
   String disable_eval_error_message_;
   WebInsecureRequestPolicy insecure_request_policy_;
 
   Member<CSPSource> self_source_;
   String self_protocol_;
 };
 
 }  // namespace blink
 
 #endif