CSP: Deduplicate violation reports before sending.

Source/core/page/ContentSecurityPolicy.h

Index: Source/core/page/ContentSecurityPolicy.h
diff --git a/Source/core/page/ContentSecurityPolicy.h b/Source/core/page/ContentSecurityPolicy.h
index 444455fd25b2cbb1fbb1a719558b63113835e701..f25a2c094f5b08df878d6cd5dbb7dafc6044f631 100644
--- a/Source/core/page/ContentSecurityPolicy.h
+++ b/Source/core/page/ContentSecurityPolicy.h
@@ -27,6 +27,7 @@
 #define ContentSecurityPolicy_h
 
 #include "bindings/v8/ScriptState.h"
+#include "wtf/HashSet.h"
 #include "wtf/PassOwnPtr.h"
 #include "wtf/Vector.h"
 #include "wtf/text/TextPosition.h"
@@ -41,6 +42,7 @@ namespace WebCore {
 class ContentSecurityPolicyResponseHeaders;
 class CSPDirectiveList;
 class DOMStringList;
+class JSONObject;
 class KURL;
 class ScriptExecutionContext;
 class SecurityOrigin;
@@ -125,7 +127,7 @@ public:
     void reportInvalidReflectedXSS(const String&) const;
     void reportMissingReportURI(const String&) const;
     void reportUnsupportedDirective(const String&) const;
-    void reportViolation(const String& directiveText, const String& effectiveDirective, const String& consoleMessage, const KURL& blockedURL, const Vector<KURL>& reportURIs, const String& header, const String& contextURL = String(), const WTF::OrdinalNumber& contextLine = WTF::OrdinalNumber::beforeFirst(), ScriptState* = 0) const;
+    void reportViolation(const String& directiveText, const String& effectiveDirective, const String& consoleMessage, const KURL& blockedURL, const Vector<KURL>& reportURIs, const String& header, const String& contextURL = String(), const WTF::OrdinalNumber& contextLine = WTF::OrdinalNumber::beforeFirst(), ScriptState* = 0);
 
     void reportBlockedScriptExecutionToInspector(const String& directiveText) const;
 
@@ -145,9 +147,14 @@ private:
     void logToConsole(const String& message, const String& contextURL = String(), const WTF::OrdinalNumber& contextLine = WTF::OrdinalNumber::beforeFirst(), ScriptState* = 0) const;
     void addPolicyFromHeaderValue(const String&, HeaderType);
 
+    bool shouldSendViolationReport(PassRefPtr<JSONObject>) const;
+    void didSendViolationReport(PassRefPtr<JSONObject>);
+
     ScriptExecutionContext* m_scriptExecutionContext;
     bool m_overrideInlineStyleAllowed;
     CSPDirectiveListVector m_policies;
+
+    HashSet<unsigned> m_violationReportsSent;

[Tom Sepez, 2013/08/02 18:03:22]

Any chance of making this a 64-bit unsigned? Not much downside to a collision,
but still ... guess that depends on whether we have a 64-bit hash function
available.

[abarth-chromium, 2013/08/02 18:04:28]

There's an "AlreadyHashed" parameter that you can add to the HashSet template
args to let the collection know that the unsigned values are already
well-distributed.  There should be examples around.

 };
 
 }