Forward CSP violation reporting from RenderFrameProxy to RenderFrameImpl.

third_party/WebKit/Source/web/WebLocalFrameImpl.cpp

Index: third_party/WebKit/Source/web/WebLocalFrameImpl.cpp
diff --git a/third_party/WebKit/Source/web/WebLocalFrameImpl.cpp b/third_party/WebKit/Source/web/WebLocalFrameImpl.cpp
index 6fc3d8e910afe2a966227225e9592acd23fa483b..21232330efa6b513f3b2a3c55fbe32956dc8869c 100644
--- a/third_party/WebKit/Source/web/WebLocalFrameImpl.cpp
+++ b/third_party/WebKit/Source/web/WebLocalFrameImpl.cpp
@@ -2160,4 +2160,41 @@ void WebLocalFrameImpl::clearActiveFindMatch()
     ensureTextFinder().clearActiveFindMatch();
 }
 
+void WebLocalFrameImpl::reportContentSecurityPolicyViolation(
+    const WebString& directiveText,
+    const WebString& effectiveDirective,
+    const WebString& consoleMessage,
+    const WebURL& blockedURL,
+    const WebVector<WebString>& reportEndpoints,
+    const WebString& header,
+    WebContentSecurityPolicyViolationType violationType,
+    bool followedRedirect)
+{
+    Vector<String> coreReportEndpoints;
+    coreReportEndpoints.reserveInitialCapacity(reportEndpoints.size());
+    for (const WebString& reportEndpoint : reportEndpoints)
+        coreReportEndpoints.append(reportEndpoint);
+
+    auto redirectStatus = followedRedirect
+        ? ResourceRequest::RedirectStatus::FollowedRedirect
+        : ResourceRequest::RedirectStatus::NoRedirect;
+
+    ContentSecurityPolicy* policy = m_frame->securityContext()->contentSecurityPolicy();
+    policy->logToConsole(ConsoleMessage::create(
+        SecurityMessageSource,
+        ErrorMessageLevel,
+        consoleMessage));
+    policy->reportViolation(
+        directiveText,
+        effectiveDirective,
+        consoleMessage,
+        blockedURL,
+        coreReportEndpoints,
+        header,
+        static_cast<ContentSecurityPolicy::ViolationType>(violationType),
+        nullptr, // contextFrame

[alexmos, 2016/08/09 18:01:20]

Looking at when reportViolation uses |contextFrame|, it seems it's used for
frame-ancestors.  So would we need to plumb this for the browser->renderer path
when the browser process starts enforcing frame-ancestors?

[Łukasz Anforowicz, 2016/08/09 22:23:20]

I am not sure.  I don't think so.  I am not sure how exactly |contextFrame| is
used in ContentSecurityPolicy::reportViolation (e.g. why and how it influences
|url| passed to PingLoader::sendViolationReport).  But... I think that instead
of passing |contextFrame|, we could just invoke
ContentSecurityPolicy::reportViolation associated with the right frame (so that
|this->document()| can always be used instead of having to do |contextFrame ?
contextFrame->document() : this->document()|).

[alexmos, 2016/08/10 20:34:33]

Acknowledged.

+        redirectStatus,
+        0); // contextLine

[alexmos, 2016/08/09 18:01:20]

nit: maybe a comment explaining why we don't have/want the line number? 
(Similar to the one you have in RemoteContentSecurityPolicy.cpp)

[Łukasz Anforowicz, 2016/08/09 22:23:20]

Done.

+}
+
 } // namespace blink