Make mixed content checking and CSP aware of RemoteFrames

Source/core/frame/csp/CSPDirectiveList.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/frame/csp/CSPDirectiveList.h"
 
 #include "core/frame/LocalFrame.h"
 #include "platform/ParsingUtilities.h"
 #include "platform/weborigin/KURL.h"
@@ skipping 74 matching lines @@
 bool CSPDirectiveList::checkSource(SourceListDirective* directive, const KURL& url) const
 {
     return !directive || directive->allows(url);
 }
 
 bool CSPDirectiveList::checkAncestors(SourceListDirective* directive, LocalFrame* frame) const
 {
     if (!frame || !directive)
         return true;
 
-    for (LocalFrame* current = frame->tree().parent(); current; current = current->tree().parent()) {
-        if (!directive->allows(current->document()->url()))
+    for (Frame* current = frame->tree().parent(); current; current = current->tree().parent()) {
+        // FIXME: To make this work for out-of-process iframes, we need to propagate URL information of ancestor frames across processes.
+        if (!current->isLocalFrame() || !directive->allows(toLocalFrame(current)->document()->url()))

[Mike West, 2014/05/29 09:47:41]

This will block loading any page that sets a frame-ancestor directive if it's
somewhere nested in a chain that includes a RemoteFrame. Do we create those
today, or will those only pop up in an OOP world?

[kenrb, 2014/05/29 13:38:41]

RemoteFrames will only be used behind a flag until we are ready to launch this
feature.

             return false;
     }
     return true;
 }
 
 bool CSPDirectiveList::checkMediaType(MediaListDirective* directive, const String& type, const String& typeAttribute) const
 {
     if (!directive)
         return true;
     if (typeAttribute.isEmpty() || typeAttribute.stripWhiteSpace() != type)
@@ skipping 563 matching lines @@
         else
             m_policy->reportUnsupportedDirective(name);
     } else {
         m_policy->reportUnsupportedDirective(name);
     }
 }
 
 
 } // namespace WebCore