Forward CSP violation reporting from RenderFrameProxy to RenderFrameImpl.

third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp

 /*
  * Copyright (C) 2011 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 823 matching lines @@
         KURL source = KURL(ParsedURLString, location->url());
         init.setSourceFile(stripURLForUseInReport(document, source, redirectStatus));
         init.setLineNumber(location->lineNumber());
         init.setColumnNumber(location->columnNumber());
     }
 }
 
 void ContentSecurityPolicy::reportViolation(const String& directiveText, const String& effectiveDirective, const String& consoleMessage, const KURL& blockedURL, const Vector<String>& reportEndpoints, const String& header, ViolationType violationType, LocalFrame* contextFrame, RedirectStatus redirectStatus, int contextLine)
 {
     ASSERT(violationType == URLViolation || blockedURL.isEmpty());
-
-    // TODO(lukasza): Support sending reports from OOPIFs - https://crbug.com/611232
-    // (or move CSP child-src and frame-src checks to the browser process - see
-    // https://crbug.com/376522).
-    if (!m_executionContext && !contextFrame) {
-        DCHECK(equalIgnoringCase(effectiveDirective, ContentSecurityPolicy::ChildSrc)
-            || equalIgnoringCase(effectiveDirective, ContentSecurityPolicy::FrameSrc));
-        return;
-    }
-
     ASSERT((m_executionContext && !contextFrame) || (equalIgnoringCase(effectiveDirective, ContentSecurityPolicy::FrameAncestors) && contextFrame));
 
     // FIXME: Support sending reports from worker.
     Document* document = contextFrame ? contextFrame->document() : this->document();
     if (!document)
         return;
 
     SecurityPolicyViolationEventInit violationData;
     gatherSecurityPolicyViolationEventData(violationData, document, directiveText, effectiveDirective, blockedURL, header, redirectStatus, violationType, contextLine);
 
@@ skipping 254 matching lines @@
 {
     // Collisions have no security impact, so we can save space by storing only the string's hash rather than the whole report.
     return !m_violationReportsSent.contains(report.impl()->hash());
 }
 
 void ContentSecurityPolicy::didSendViolationReport(const String& report)
 {
     m_violationReportsSent.add(report.impl()->hash());
 }
 
+bool ContentSecurityPolicy::coversReportEndpoint(const String& reportEndpointToVerify)
+{
+    for (const auto& policyList : m_policies) {
+        for (const String& actualReportEndpoint : policyList->reportEndpoints()) {
+            if (actualReportEndpoint == reportEndpointToVerify)
+                return true;
+        }
+    }
+    return false;
+}
+
 } // namespace blink