CSP violation reports should report the pre-redirect URL.

third_party/WebKit/Source/core/loader/MixedContentChecker.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 289 matching lines @@
         break;
 
     default:
         ASSERT_NOT_REACHED();
         return;
     }
     UseCounter::count(frame, feature);
 }
 
 // static
-bool MixedContentChecker::shouldBlockFetch(LocalFrame* frame, WebURLRequest::RequestContext requestContext, WebURLRequest::FrameType frameType, const KURL& url, MixedContentChecker::ReportingStatus reportingStatus)
+bool MixedContentChecker::shouldBlockFetch(LocalFrame* frame, WebURLRequest::RequestContext requestContext, WebURLRequest::FrameType frameType, ResourceRequest::RedirectStatus redirectStatus, const KURL& url, MixedContentChecker::ReportingStatus reportingStatus)
 {
     Frame* effectiveFrame = effectiveFrameForFrameType(frame, frameType);
     Frame* mixedFrame = inWhichFrameIsContentMixed(effectiveFrame, frameType, url);
     if (!mixedFrame)
         return false;
 
     MixedContentChecker::count(mixedFrame, requestContext);
     if (ContentSecurityPolicy* policy = frame->securityContext()->contentSecurityPolicy())
-        policy->reportMixedContent(url);
+        policy->reportMixedContent(url, redirectStatus);
 
     Settings* settings = mixedFrame->settings();
     // Use the current local frame's client; the embedder doesn't
     // distinguish mixed content signals from different frames on the
     // same page.
     FrameLoaderClient* client = frame->loader().client();
     SecurityOrigin* securityOrigin = mixedFrame->securityContext()->getSecurityOrigin();
     bool allowed = false;
 
     // If we're in strict mode, we'll automagically fail everything, and intentionally skip
@@ skipping 71 matching lines @@
 // static
 bool MixedContentChecker::shouldBlockWebSocket(LocalFrame* frame, const KURL& url, MixedContentChecker::ReportingStatus reportingStatus)
 {
     Frame* mixedFrame = inWhichFrameIsContentMixed(frame, WebURLRequest::FrameTypeNone, url);
     if (!mixedFrame)
         return false;
 
     UseCounter::count(mixedFrame, UseCounter::MixedContentPresent);
     UseCounter::count(mixedFrame, UseCounter::MixedContentWebSocket);
     if (ContentSecurityPolicy* policy = frame->securityContext()->contentSecurityPolicy())
-        policy->reportMixedContent(url);
+        policy->reportMixedContent(url, ResourceRequest::RedirectStatus::NoRedirect);
 
     Settings* settings = mixedFrame->settings();
     // Use the current local frame's client; the embedder doesn't
     // distinguish mixed content signals from different frames on the
     // same page.
     FrameLoaderClient* client = frame->loader().client();
     SecurityOrigin* securityOrigin = mixedFrame->securityContext()->getSecurityOrigin();
     bool allowed = false;
 
     // If we're in strict mode, we'll automagically fail everything, and intentionally skip
@@ skipping 95 matching lines @@
 
     // See comment in shouldBlockFetch() about loading the main resource of a subframe.
     if (request.frameType() == WebURLRequest::FrameTypeNested && !SchemeRegistry::shouldTreatURLSchemeAsCORSEnabled(request.url().protocol())) {
         return ContextTypeOptionallyBlockable;
     }
 
     return contextTypeFromContext(request.requestContext(), mixedFrame);
 }
 
 } // namespace blink