CSP: Measure whether we can treat '<meta http-refresh>' as inline script.

third_party/WebKit/Source/core/loader/HttpEquiv.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/loader/HttpEquiv.h"
 
 #include "core/dom/Document.h"
 #include "core/dom/ScriptableDocumentParser.h"
 #include "core/dom/StyleEngine.h"
 #include "core/fetch/ClientHintsPreferences.h"
@@ skipping 60 matching lines @@
     document.clientHintsPreferences().updateFromAcceptClientHintsHeader(content, document.fetcher());
 }
 
 void HttpEquiv::processHttpEquivDefaultStyle(Document& document, const AtomicString& content)
 {
     document.styleEngine().setHttpDefaultStyle(content);
 }
 
 void HttpEquiv::processHttpEquivRefresh(Document& document, const AtomicString& content)
 {
+    UseCounter::count(document, UseCounter::MetaRefresh);
+    if (!document.contentSecurityPolicy()->allowInlineScript(KURL(), "", OrdinalNumber(), "", ContentSecurityPolicy::SuppressReport))
+        UseCounter::count(document, UseCounter::MetaRefreshWhenCSPBlocksInlineScript);
+
     document.maybeHandleHttpRefresh(content, Document::HttpRefreshFromMetaTag);
 }
 
 void HttpEquiv::processHttpEquivSetCookie(Document& document, const AtomicString& content)
 {
     // FIXME: make setCookie work on XML documents too; e.g. in case of <html:meta .....>
     if (!document.isHTMLDocument())
         return;
 
+    UseCounter::count(document, UseCounter::MetaSetCookie);
+    if (!document.contentSecurityPolicy()->allowInlineScript(KURL(), "", OrdinalNumber(), "", ContentSecurityPolicy::SuppressReport))
+        UseCounter::count(document, UseCounter::MetaSetCookieWhenCSPBlocksInlineScript);
+
     // Exception (for sandboxed documents) ignored.
     document.setCookie(content, IGNORE_EXCEPTION);
 }
 
 } // namespace blink