CSP: Check <param> element values against the document's CSP before loading.

Source/core/html/HTMLPlugInElement.cpp

Index: Source/core/html/HTMLPlugInElement.cpp
diff --git a/Source/core/html/HTMLPlugInElement.cpp b/Source/core/html/HTMLPlugInElement.cpp
index ebbbdd8bfaca2ce0bf9ed10d389d7796e00871be..3220aafaada705f56ca9da1ac79b7d8bc67fe368 100644
--- a/Source/core/html/HTMLPlugInElement.cpp
+++ b/Source/core/html/HTMLPlugInElement.cpp
@@ -28,6 +28,7 @@
 #include "bindings/v8/ScriptController.h"
 #include "bindings/v8/npruntime_impl.h"
 #include "core/dom/Document.h"
+#include "core/dom/Node.h"
 #include "core/dom/PostAttachCallbacks.h"
 #include "core/events/Event.h"
 #include "core/frame/ContentSecurityPolicy.h"
@@ -407,6 +408,8 @@ bool HTMLPlugInElement::requestObject(const String& url, const String& mimeType,
         return false;
 
     KURL completedURL = document().completeURL(url);
+    if (!pluginIsLoadable(completedURL, mimeType))
+        return false;
 
     bool useFallback;
     if (shouldUsePlugin(completedURL, mimeType, renderer->hasFallbackContent(), useFallback))
@@ -426,9 +429,6 @@ bool HTMLPlugInElement::loadPlugin(const KURL& url, const String& mimeType, cons
     if (!frame->loader().allowPlugins(AboutToInstantiatePlugin))
         return false;
 
-    if (!pluginIsLoadable(url, mimeType))
-        return false;
-
     RenderEmbeddedObject* renderer = renderEmbeddedObject();
     // FIXME: This code should not depend on renderer!
     if (!renderer || useFallback)
@@ -474,6 +474,14 @@ bool HTMLPlugInElement::shouldUsePlugin(const KURL& url, const String& mimeType,
 
 }
 
+void HTMLPlugInElement::dispatchErrorEvent()
+{
+    if (document().isPluginDocument() && document().ownerElement())
+        document().ownerElement()->dispatchEvent(Event::create(EventTypeNames::error));
+    else
+        dispatchEvent(Event::create(EventTypeNames::error));
+}
+
 bool HTMLPlugInElement::pluginIsLoadable(const KURL& url, const String& mimeType)
 {
     Frame* frame = document().frame();