{"push_id":1116155890,"size":1,"distinct_size":1,"ref":"refs/heads/master","head":"8e1c02e4ee2f50b204c234c033d09a4a866bf932","before":"031b9b282df12ccb505f8692a95d00cc18ba1e52","commits":[{"sha":"8e1c02e4ee2f50b204c234c033d09a4a866bf932","author":{"email":"a51ae48846d0b3cf5988abc57a8fe0c614542511@chromium.org","name":"lukasza"},"message":"Replicate Content-Security-Policy into remote frame proxies.\n\nAfter this CL, when a local frame parses a new CSP header (from http\nheaders, from <meta> element, or when copying CSP from the parent frame\nin case of about:blank children), a notification will be sent all the\nway to the browser.  The browser will store the CSP accumulated headers\nin FrameReplicationState and notify RenderFrameProxies.\nRenderFrameProxy will take care of using CSP headers received from the\nbrowser to fill out RemoteSecurityContext's ContentSecurityPolicy.\n\nAfter this CL, frame-src is properly enforced when navigating a frame\nwhen its parent is a remote frame proxy.  For example, when running\nhttp/tests/security/contentSecurityPolicy/frame-src-child-frame-navigates-to-blocked-origin.html\nthe subframe navigation is blocked after this CL.  OTOH, we cannot yet\nenable this test, because the console message about CSP violation is\ncurrently dropped when CSP comes from a remote frame.  To work around\nthis, a few regression tests are being added by this CL as browser\ntests.\n\nBUG=585501\nCQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_site_isolation\n\nReview-Url: https://codereview.chromium.org/1957783002\nCr-Commit-Position: refs/heads/master@{#394200}","distinct":true,"url":"https://api.github.com/repos/dstockwell/chromium/commits/8e1c02e4ee2f50b204c234c033d09a4a866bf932"}]}