Move plugin placeholder style to CSS, and allow it to bypass main world CSP.

Source/bindings/core/v8/ScriptController.h

Index: Source/bindings/core/v8/ScriptController.h
diff --git a/Source/bindings/core/v8/ScriptController.h b/Source/bindings/core/v8/ScriptController.h
index 931275d5dcc4d264063616ee006d2bceb5ae7b8d..e8120e94f205ec7a1bf8c7b494554d3ef94ea711 100644
--- a/Source/bindings/core/v8/ScriptController.h
+++ b/Source/bindings/core/v8/ScriptController.h
@@ -38,6 +38,7 @@
 #include "wtf/Forward.h"
 #include "wtf/HashMap.h"
 #include "wtf/RefCounted.h"
+#include "wtf/TemporaryChange.h"
 #include "wtf/Vector.h"
 #include "wtf/text/TextPosition.h"
 #include <v8.h>
@@ -105,6 +106,8 @@ public:
     // Returns true if the current world is isolated, and has its own Content
     // Security Policy. In this case, the policy of the main world should be
     // ignored when evaluating resources injected into the DOM.
+    // Alternatively, this can be explicitly forced to true within a scope
+    // using BypassMainWorldCSP.
     bool shouldBypassMainWorldCSP();
 
     // Creates a property of the global object of a frame.
@@ -149,6 +152,15 @@ public:
 
     v8::Isolate* isolate() const { return m_isolate; }
 
+    class BypassMainWorldCSP : public TemporaryChange<bool> {

[haraken, 2014/09/01 00:59:43]

The idea of introducing BypassMainWorldCSP looks good, but the implementation
looks a bit too complicated (e.g., we don't want to add a friend class). In
addition, it's a bit dangerous to provide a general way to bypass the main world
CSP. We should limit the usage only to private scripts.

How about implementing a helper method like this?

// static method of PrivateScriptRunner
void PrivateScriptRunner::injectCSS(Element* parentElement, String cssSource) {
  ...;
  scriptController->setBypassMainWorldCSP(true);
  ...; // Do the actual work to inject the CSS to parentElement.
  scriptController->setBypassMainWorldCSP(false);

}

[jbroman, 2014/09/02 15:44:04]

The friend class is there to keep m_bypassMainWorldCSP private, and it seemed
clear to me that it uses no other privilege. The reason I did this instead of a
pair of methods is to prevent a caller from turning the bypass bit on and
forgetting to turn it off. This is how StyleEngine::IgnoringPendingStylesheet
works, for instance. But I don't feel strongly.

This is moot in light of the below, though.
I realized after some more investigation that there are some issues
with my original approach, namely that the times the CSP is checked
are a little complicated (it's checked only when it's in a document,
either on attachment or when children change).

The current patch set takes another approach. I'm happy to move it
into a helper if you think that's helpful.

+    public:
+        BypassMainWorldCSP(ScriptController& controller)
+            : TemporaryChange<bool>(controller.m_bypassMainWorldCSP, true)
+        {
+        }
+    };
+    friend class BypassMainWorldCSP;
+
 private:
     typedef HashMap<int, OwnPtr<WindowProxy> > IsolatedWorldMap;
     typedef HashMap<Widget*, NPObject*> PluginObjectMap;
@@ -169,6 +181,8 @@ private:
     PluginObjectMap m_pluginObjects;
 
     NPObject* m_windowScriptNPObject;
+
+    bool m_bypassMainWorldCSP;
 };
 
 } // namespace blink