Add `disposition` to SecurityPolicyViolationEvent

third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPDirectiveList.h"
 
 #include "bindings/core/v8/SourceLocation.h"
 #include "core/dom/Document.h"
 #include "core/dom/SecurityContext.h"
 #include "core/dom/SpaceSplitString.h"
@@ skipping 60 matching lines @@
     }
 
     if (directives->isReportOnly() && source != ContentSecurityPolicyHeaderSourceMeta && directives->reportEndpoints().isEmpty())
         policy->reportMissingReportURI(String(begin, end - begin));
 
     return directives;
 }
 
 void CSPDirectiveList::reportViolation(const String& directiveText, const String& effectiveDirective, const String& consoleMessage, const KURL& blockedURL, ResourceRequest::RedirectStatus redirectStatus) const
 {
-    String message = m_reportOnly ? "[Report Only] " + consoleMessage : consoleMessage;
+    String message;
+    ContentSecurityPolicy::DispositionType dispositionType;

[Mike West, 2016/09/14 13:03:01]

If you move to `ContentSecurityPolicyHeaderType`, you can just use
`m_headerType` here.

In hindsight, I'm not sure why we have both `m_headerType` and `m_reportOnly`.
Combining those seems like a reasonable cleanup CL for the future.

[Sergey Shekyan, 2016/09/16 05:36:45]

It is confusing to me. I can refactor in another PR.

+    if (m_reportOnly) {
+        message = "[Report Only] " + consoleMessage;
+        dispositionType = ContentSecurityPolicy::Report;
+    } else {
+        message = consoleMessage;
+        dispositionType = ContentSecurityPolicy::Enforce;
+    }
+
     m_policy->logToConsole(ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel, message));
-    m_policy->reportViolation(directiveText, effectiveDirective, message, blockedURL, m_reportEndpoints, m_header, ContentSecurityPolicy::URLViolation, nullptr, redirectStatus);
+    m_policy->reportViolation(directiveText, dispositionType, effectiveDirective, message, blockedURL, m_reportEndpoints, m_header, ContentSecurityPolicy::URLViolation, nullptr, redirectStatus);
 }
 
 void CSPDirectiveList::reportViolationWithFrame(const String& directiveText, const String& effectiveDirective, const String& consoleMessage, const KURL& blockedURL, LocalFrame* frame) const
 {
-    String message = m_reportOnly ? "[Report Only] " + consoleMessage : consoleMessage;
+    String message;
+    ContentSecurityPolicy::DispositionType dispositionType;
+    if (m_reportOnly) {
+        message = "[Report Only] " + consoleMessage;
+        dispositionType = ContentSecurityPolicy::Report;
+    } else {
+        message = consoleMessage;
+        dispositionType = ContentSecurityPolicy::Enforce;
+    }
+
     m_policy->logToConsole(ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel, message), frame);
-    m_policy->reportViolation(directiveText, effectiveDirective, message, blockedURL, m_reportEndpoints, m_header, ContentSecurityPolicy::URLViolation, frame);
+    m_policy->reportViolation(directiveText, dispositionType, effectiveDirective, message, blockedURL, m_reportEndpoints, m_header, ContentSecurityPolicy::URLViolation, frame);
 }
 
 void CSPDirectiveList::reportViolationWithLocation(const String& directiveText, const String& effectiveDirective, const String& consoleMessage, const KURL& blockedURL, const String& contextURL, const WTF::OrdinalNumber& contextLine) const
 {
-    String message = m_reportOnly ? "[Report Only] " + consoleMessage : consoleMessage;
+    String message;
+    ContentSecurityPolicy::DispositionType dispositionType;
+    if (m_reportOnly) {
+        message = "[Report Only] " + consoleMessage;
+        dispositionType = ContentSecurityPolicy::Report;
+    } else {
+        message = consoleMessage;
+        dispositionType = ContentSecurityPolicy::Enforce;
+    }
+
     m_policy->logToConsole(ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel, message, SourceLocation::capture(contextURL, contextLine.oneBasedInt(), 0)));
-    m_policy->reportViolation(directiveText, effectiveDirective, message, blockedURL, m_reportEndpoints, m_header, ContentSecurityPolicy::InlineViolation, nullptr, RedirectStatus::NoRedirect, contextLine.oneBasedInt());
+    m_policy->reportViolation(directiveText, dispositionType, effectiveDirective, message, blockedURL, m_reportEndpoints, m_header, ContentSecurityPolicy::InlineViolation, nullptr, RedirectStatus::NoRedirect, contextLine.oneBasedInt());
 }
 
 void CSPDirectiveList::reportViolationWithState(const String& directiveText, const String& effectiveDirective, const String& message, const KURL& blockedURL, ScriptState* scriptState, const ContentSecurityPolicy::ExceptionStatus exceptionStatus) const
 {
-    String reportMessage = m_reportOnly ? "[Report Only] " + message : message;
+    String reportMessage;
+    ContentSecurityPolicy::DispositionType dispositionType;
+    if (m_reportOnly) {
+        reportMessage = "[Report Only] " + message;
+        dispositionType = ContentSecurityPolicy::Report;
+    } else {
+        reportMessage = message;
+        dispositionType = ContentSecurityPolicy::Enforce;
+    }
+
     // Print a console message if it won't be redundant with a
     // JavaScript exception that the caller will throw. (Exceptions will
     // never get thrown in report-only mode because the caller won't see
     // a violation.)
     if (m_reportOnly || exceptionStatus == ContentSecurityPolicy::WillNotThrowException) {
         ConsoleMessage* consoleMessage = ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel, reportMessage);
         m_policy->logToConsole(consoleMessage);
     }
-    m_policy->reportViolation(directiveText, effectiveDirective, message, blockedURL, m_reportEndpoints, m_header, ContentSecurityPolicy::EvalViolation);
+    m_policy->reportViolation(directiveText, dispositionType, effectiveDirective, message, blockedURL, m_reportEndpoints, m_header, ContentSecurityPolicy::EvalViolation);
 }
 
 bool CSPDirectiveList::checkEval(SourceListDirective* directive) const
 {
     return !directive || directive->allowEval();
 }
 
 bool CSPDirectiveList::checkInline(SourceListDirective* directive) const
 {
     return !directive || (directive->allowInline() && !directive->isHashOrNoncePresent());
@@ skipping 15 matching lines @@
 }
 
 bool CSPDirectiveList::checkDynamic(SourceListDirective* directive) const
 {
     return !directive || directive->allowDynamic();
 }
 
 void CSPDirectiveList::reportMixedContent(const KURL& mixedURL, ResourceRequest::RedirectStatus redirectStatus) const
 {
     if (strictMixedContentChecking())
-        m_policy->reportViolation(ContentSecurityPolicy::BlockAllMixedContent, ContentSecurityPolicy::BlockAllMixedContent, String(), mixedURL, m_reportEndpoints, m_header, ContentSecurityPolicy::URLViolation, nullptr, redirectStatus);
+        m_policy->reportViolation(ContentSecurityPolicy::BlockAllMixedContent, m_reportOnly ? ContentSecurityPolicy::Report : ContentSecurityPolicy::Enforce, ContentSecurityPolicy::BlockAllMixedContent, String(), mixedURL, m_reportEndpoints, m_header, ContentSecurityPolicy::URLViolation, nullptr, redirectStatus);
 }
 
 bool CSPDirectiveList::checkSource(SourceListDirective* directive, const KURL& url, ResourceRequest::RedirectStatus redirectStatus) const
 {
     // If |url| is empty, fall back to the policy URL to ensure that <object>'s
     // without a `src` can be blocked/allowed, as they can still load plugins
     // even though they don't actually have a URL.
     return !directive || directive->allows(url.isEmpty() ? m_policy->url() : url, redirectStatus);
 }
 
@@ skipping 806 matching lines @@
     visitor->trace(m_imgSrc);
     visitor->trace(m_mediaSrc);
     visitor->trace(m_manifestSrc);
     visitor->trace(m_objectSrc);
     visitor->trace(m_scriptSrc);
     visitor->trace(m_styleSrc);
 }
 
 
 } // namespace blink