Move plugin placeholder style to CSS, and allow it to bypass main world CSP.

Source/bindings/core/v8/ScriptController.h

 /*
  * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 20 matching lines @@
 #ifndef ScriptController_h
 #define ScriptController_h
 
 #include "bindings/core/v8/ScriptValue.h"
 #include "bindings/core/v8/SharedPersistent.h"
 
 #include "core/fetch/CrossOriginAccessControl.h"
 #include "wtf/Forward.h"
 #include "wtf/HashMap.h"
 #include "wtf/RefCounted.h"
+#include "wtf/TemporaryChange.h"
 #include "wtf/Vector.h"
 #include "wtf/text/TextPosition.h"
 #include <v8.h>
 
 struct NPObject;
 
 namespace blink {
 
 class DOMWrapperWorld;
 class ExecutionContext;
@@ skipping 47 matching lines @@
 
     // Returns true if argument is a JavaScript URL.
     bool executeScriptIfJavaScriptURL(const KURL&);
 
     v8::Local<v8::Value> callFunction(v8::Handle<v8::Function>, v8::Handle<v8::Value>, int argc, v8::Handle<v8::Value> argv[]);
     static v8::Local<v8::Value> callFunction(ExecutionContext*, v8::Handle<v8::Function>, v8::Handle<v8::Value> receiver, int argc, v8::Handle<v8::Value> info[], v8::Isolate*);
 
     // Returns true if the current world is isolated, and has its own Content
     // Security Policy. In this case, the policy of the main world should be
     // ignored when evaluating resources injected into the DOM.
+    // Alternatively, this can be explicitly forced to true within a scope
+    // using BypassMainWorldCSP.
     bool shouldBypassMainWorldCSP();
 
     // Creates a property of the global object of a frame.
     void bindToWindowObject(LocalFrame*, const String& key, NPObject*);
 
     PassRefPtr<SharedPersistent<v8::Object> > createPluginWrapper(Widget*);
 
     void enableEval();
     void disableEval(const String& errorMessage);
 
@@ skipping 24 matching lines @@
     // Registers a v8 extension to be available on webpages. Will only
     // affect v8 contexts initialized after this call. Takes ownership of
     // the v8::Extension object passed.
     static void registerExtensionIfNeeded(v8::Extension*);
     static V8Extensions& registeredExtensions();
 
     void setWorldDebugId(int worldId, int debuggerId);
 
     v8::Isolate* isolate() const { return m_isolate; }
 
+    class BypassMainWorldCSP : public TemporaryChange<bool> {

[haraken, 2014/09/01 00:59:43]

The idea of introducing BypassMainWorldCSP looks good, but the implementation
looks a bit too complicated (e.g., we don't want to add a friend class). In
addition, it's a bit dangerous to provide a general way to bypass the main world
CSP. We should limit the usage only to private scripts.

How about implementing a helper method like this?

// static method of PrivateScriptRunner
void PrivateScriptRunner::injectCSS(Element* parentElement, String cssSource) {
  ...;
  scriptController->setBypassMainWorldCSP(true);
  ...; // Do the actual work to inject the CSS to parentElement.
  scriptController->setBypassMainWorldCSP(false);

}

[jbroman, 2014/09/02 15:44:04]

The friend class is there to keep m_bypassMainWorldCSP private, and it seemed
clear to me that it uses no other privilege. The reason I did this instead of a
pair of methods is to prevent a caller from turning the bypass bit on and
forgetting to turn it off. This is how StyleEngine::IgnoringPendingStylesheet
works, for instance. But I don't feel strongly.

This is moot in light of the below, though.
I realized after some more investigation that there are some issues
with my original approach, namely that the times the CSP is checked
are a little complicated (it's checked only when it's in a document,
either on attachment or when children change).

The current patch set takes another approach. I'm happy to move it
into a helper if you think that's helpful.

+    public:
+        BypassMainWorldCSP(ScriptController& controller)
+            : TemporaryChange<bool>(controller.m_bypassMainWorldCSP, true)
+        {
+        }
+    };
+    friend class BypassMainWorldCSP;
+
 private:
     typedef HashMap<int, OwnPtr<WindowProxy> > IsolatedWorldMap;
     typedef HashMap<Widget*, NPObject*> PluginObjectMap;
 
     v8::Local<v8::Value> evaluateScriptInMainWorld(const ScriptSourceCode&, AccessControlStatus, ExecuteScriptPolicy);
 
     LocalFrame* m_frame;
     const String* m_sourceURL;
     v8::Isolate* m_isolate;
 
     OwnPtr<WindowProxy> m_windowProxy;
     IsolatedWorldMap m_isolatedWorlds;
 
     // A mapping between Widgets and their corresponding script object.
     // This list is used so that when the plugin dies, we can immediately
     // invalidate all sub-objects which are associated with that plugin.
     // The frame keeps a NPObject reference for each item on the list.
     PluginObjectMap m_pluginObjects;
 
     NPObject* m_windowScriptNPObject;
+
+    bool m_bypassMainWorldCSP;
 };
 
 } // namespace blink
 
 #endif // ScriptController_h