CSP: 'frame-src' should block redirects to invalid sources.
https://bugs.webkit.org/show_bug.cgi?id=106084

Reviewed by Adam Barth.

Source/WebCore:

The 'frame-src' CSP directive whitelists valid iframe targets, but
currently fails to correctly deal with redirection. As long as the
initial target is valid, any redirection goes through without
question. This patch moves the CSP check out of
SubframeLoader::loadSubframe, and into
PolicyChecker::checkNavigationPolicy. In the new location, the check
is well-positioned to check each URL in a redirect chain, as opposed
to checking only the initial target.

Test: http/tests/security/contentSecurityPolicy/frame-src-redirect-blocked.html

* loader/PolicyChecker.cpp:
(WebCore::PolicyChecker::checkNavigationPolicy):
* loader/SubframeLoader.cpp:
(WebCore::SubframeLoader::loadSubframe):

LayoutTests:

* http/tests/security/contentSecurityPolicy/frame-src-redirect-blocked-expected.txt: Added.
* http/tests/security/contentSecurityPolicy/frame-src-redirect-blocked.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@138818 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Crash in media/unsupported-rtsp.html.
https://bugs.webkit.org/show_bug.cgi?id=106038

Reviewed by Eric Carlson.

Fixes media/unsupported-rtsp.html on Mac platforms which support AVAssetResourceLoadingRequest.

Check that the CachedResource passed in the notifyFinished method didn't fail or error before
passing its (possibly nil) contents to the AVAssetResourceLoadingRequest.

* platform/graphics/avfoundation/objc/WebCoreAVFResourceLoader.mm:
(WebCore::WebCoreAVFResourceLoader::notifyFinished):
(WebCore::WebCoreAVFResourceLoader::fulfillRequestWithResource):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@138819 268f45cc-cd09-0410-ab3c-d52691b4dbfc