Implement CSP check for manifest fetching

Source/core/frame/csp/CSPDirectiveList.cpp

Index: Source/core/frame/csp/CSPDirectiveList.cpp
diff --git a/Source/core/frame/csp/CSPDirectiveList.cpp b/Source/core/frame/csp/CSPDirectiveList.cpp
index 792472dede5bc17eeba85e09c26d7cd8ba36f8c0..4fa58b5e82c21887567c9d6dd7555f01f83bb5a3 100644
--- a/Source/core/frame/csp/CSPDirectiveList.cpp
+++ b/Source/core/frame/csp/CSPDirectiveList.cpp
@@ -200,6 +200,8 @@ bool CSPDirectiveList::checkSourceAndReportViolation(SourceListDirective* direct
         prefix = "Refused to load the image '";
     else if (ContentSecurityPolicy::MediaSrc == effectiveDirective)
         prefix = "Refused to load media from '";
+    else if (ContentSecurityPolicy::ManifestSrc == effectiveDirective)
+        prefix = "Refused to load manifest from '";
     else if (ContentSecurityPolicy::ObjectSrc == effectiveDirective)
         prefix = "Refused to load plugin data from '";
     else if (ContentSecurityPolicy::ScriptSrc == effectiveDirective)
@@ -338,6 +340,13 @@ bool CSPDirectiveList::allowMediaFromSource(const KURL& url, ContentSecurityPoli
         checkSource(operativeDirective(m_mediaSrc.get()), url);
 }
 
+bool CSPDirectiveList::allowManifestFromSource(const KURL& url, ContentSecurityPolicy::ReportingStatus reportingStatus) const
+{
+    return reportingStatus == ContentSecurityPolicy::SendReport ?
+        checkSourceAndReportViolation(operativeDirective(m_manifestSrc.get()), url, ContentSecurityPolicy::ManifestSrc) :
+        checkSource(operativeDirective(m_manifestSrc.get()), url);
+}
+
 bool CSPDirectiveList::allowConnectToSource(const KURL& url, ContentSecurityPolicy::ReportingStatus reportingStatus) const
 {
     return reportingStatus == ContentSecurityPolicy::SendReport ?
@@ -653,6 +662,8 @@ void CSPDirectiveList::addDirective(const String& name, const String& value)
         setCSPDirective<SourceListDirective>(name, value, m_fontSrc);
     } else if (equalIgnoringCase(name, ContentSecurityPolicy::MediaSrc)) {
         setCSPDirective<SourceListDirective>(name, value, m_mediaSrc);
+    } else if (equalIgnoringCase(name, ContentSecurityPolicy::ManifestSrc)) {
+        setCSPDirective<SourceListDirective>(name, value, m_manifestSrc);

[Mike West, 2014/09/16 11:46:20]

This needs to be gated on a runtime flag. I think you'll need to add one for
Manifest, as I think it was removed in an earlier commit.

     } else if (equalIgnoringCase(name, ContentSecurityPolicy::ConnectSrc)) {
         setCSPDirective<SourceListDirective>(name, value, m_connectSrc);
     } else if (equalIgnoringCase(name, ContentSecurityPolicy::Sandbox)) {