Generate CSP violation reports for 'block-all-mixed-content'

third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPDirectiveList.h"
 
 #include "core/dom/Document.h"
 #include "core/dom/SecurityContext.h"
 #include "core/dom/SpaceSplitString.h"
 #include "core/frame/LocalFrame.h"
@@ skipping 122 matching lines @@
 bool CSPDirectiveList::checkHashedAttributes(SourceListDirective* directive) const
 {
     return !directive || directive->allowHashedAttributes();
 }
 
 bool CSPDirectiveList::checkDynamic(SourceListDirective* directive) const
 {
     return !directive || directive->allowDynamic();
 }
 
+void CSPDirectiveList::reportMixedContent(const KURL& mixedURL) const
+{
+    m_policy->reportViolation(ContentSecurityPolicy::BlockAllMixedContent, ContentSecurityPolicy::BlockAllMixedContent, String(), mixedURL, m_reportEndpoints, m_header, ContentSecurityPolicy::URLViolation);
+}
+
 bool CSPDirectiveList::checkSource(SourceListDirective* directive, const KURL& url, ContentSecurityPolicy::RedirectStatus redirectStatus) const
 {
     // If |url| is empty, fall back to the policy URL to ensure that <object>'s
     // without a `src` can be blocked/allowed, as they can still load plugins
     // even though they don't actually have a URL.
     return !directive || directive->allows(url.isEmpty() ? m_policy->url() : url, redirectStatus);
 }
 
 bool CSPDirectiveList::checkAncestors(SourceListDirective* directive, LocalFrame* frame) const
 {
@@ skipping 480 matching lines @@
         return;
     }
     m_treatAsPublicAddress = true;
     m_policy->treatAsPublicAddress();
     if (!value.isEmpty())
         m_policy->reportValueForEmptyDirective(name, value);
 }
 
 void CSPDirectiveList::enforceStrictMixedContentChecking(const String& name, const String& value)
 {
-    if (m_reportOnly) {
-        m_policy->reportInvalidInReportOnly(name);
-        return;
-    }
     if (m_strictMixedContentCheckingEnforced) {
         m_policy->reportDuplicateDirective(name);
         return;
     }
-    m_strictMixedContentCheckingEnforced = true;
-    m_policy->enforceStrictMixedContentChecking();
     if (!value.isEmpty())
         m_policy->reportValueForEmptyDirective(name, value);
+
+    m_strictMixedContentCheckingEnforced = true;
+
+    if (!m_reportOnly)
+        m_policy->enforceStrictMixedContentChecking();
 }
 
 void CSPDirectiveList::enableInsecureRequestsUpgrade(const String& name, const String& value)
 {
     if (m_reportOnly) {
         m_policy->reportInvalidInReportOnly(name);
         return;
     }
     if (m_upgradeInsecureRequests) {
         m_policy->reportDuplicateDirective(name);
@@ skipping 175 matching lines @@
     visitor->trace(m_imgSrc);
     visitor->trace(m_mediaSrc);
     visitor->trace(m_manifestSrc);
     visitor->trace(m_objectSrc);
     visitor->trace(m_scriptSrc);
     visitor->trace(m_styleSrc);
 }
 
 
 } // namespace blink