Add `disposition` to SecurityPolicyViolationEvent

third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPDirectiveList.h"
 
 #include "bindings/core/v8/SourceLocation.h"
 #include "core/dom/Document.h"
 #include "core/dom/SecurityContext.h"
 #include "core/dom/SpaceSplitString.h"
@@ skipping 79 matching lines @@
 void CSPDirectiveList::reportViolation(
     const String& directiveText,
     const String& effectiveDirective,
     const String& consoleMessage,
     const KURL& blockedURL,
     ResourceRequest::RedirectStatus redirectStatus) const {
   String message =
       isReportOnly() ? "[Report Only] " + consoleMessage : consoleMessage;
   m_policy->logToConsole(ConsoleMessage::create(SecurityMessageSource,
                                                 ErrorMessageLevel, message));
-  m_policy->reportViolation(
-      directiveText, effectiveDirective, message, blockedURL, m_reportEndpoints,
-      m_header, ContentSecurityPolicy::URLViolation, nullptr, redirectStatus);
+  m_policy->reportViolation(directiveText, effectiveDirective, message,
+                            blockedURL, m_reportEndpoints, m_header,
+                            m_headerType, ContentSecurityPolicy::URLViolation,
+                            nullptr, redirectStatus);
 }
 
 void CSPDirectiveList::reportViolationWithFrame(
     const String& directiveText,
     const String& effectiveDirective,
     const String& consoleMessage,
     const KURL& blockedURL,
     LocalFrame* frame) const {
   String message =
       isReportOnly() ? "[Report Only] " + consoleMessage : consoleMessage;
   m_policy->logToConsole(
       ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel, message),
       frame);
-  m_policy->reportViolation(directiveText, effectiveDirective, message,
-                            blockedURL, m_reportEndpoints, m_header,
-                            ContentSecurityPolicy::URLViolation, frame);
+  m_policy->reportViolation(
+      directiveText, effectiveDirective, message, blockedURL, m_reportEndpoints,
+      m_header, m_headerType, ContentSecurityPolicy::URLViolation, frame);
 }
 
 void CSPDirectiveList::reportViolationWithLocation(
     const String& directiveText,
     const String& effectiveDirective,
     const String& consoleMessage,
     const KURL& blockedURL,
     const String& contextURL,
     const WTF::OrdinalNumber& contextLine) const {
   String message =
       isReportOnly() ? "[Report Only] " + consoleMessage : consoleMessage;
   m_policy->logToConsole(ConsoleMessage::create(
       SecurityMessageSource, ErrorMessageLevel, message,
       SourceLocation::capture(contextURL, contextLine.oneBasedInt(), 0)));
   m_policy->reportViolation(
       directiveText, effectiveDirective, message, blockedURL, m_reportEndpoints,
-      m_header, ContentSecurityPolicy::InlineViolation, nullptr,
+      m_header, m_headerType, ContentSecurityPolicy::InlineViolation, nullptr,
       RedirectStatus::NoRedirect, contextLine.oneBasedInt());
 }
 
 void CSPDirectiveList::reportViolationWithState(
     const String& directiveText,
     const String& effectiveDirective,
     const String& message,
     const KURL& blockedURL,
     ScriptState* scriptState,
     const ContentSecurityPolicy::ExceptionStatus exceptionStatus) const {
   String reportMessage = isReportOnly() ? "[Report Only] " + message : message;
   // Print a console message if it won't be redundant with a
   // JavaScript exception that the caller will throw. (Exceptions will
   // never get thrown in report-only mode because the caller won't see
   // a violation.)
   if (isReportOnly() ||
       exceptionStatus == ContentSecurityPolicy::WillNotThrowException) {
     ConsoleMessage* consoleMessage = ConsoleMessage::create(
         SecurityMessageSource, ErrorMessageLevel, reportMessage);
     m_policy->logToConsole(consoleMessage);
   }
   m_policy->reportViolation(directiveText, effectiveDirective, message,
                             blockedURL, m_reportEndpoints, m_header,
-                            ContentSecurityPolicy::EvalViolation);
+                            m_headerType, ContentSecurityPolicy::EvalViolation);
 }
 
 bool CSPDirectiveList::checkEval(SourceListDirective* directive) const {
   return !directive || directive->allowEval();
 }
 
 bool CSPDirectiveList::checkInline(SourceListDirective* directive) const {
   return !directive ||
          (directive->allowInline() && !directive->isHashOrNoncePresent());
 }
@@ skipping 13 matching lines @@
   return !directive || directive->allowHashedAttributes();
 }
 
 bool CSPDirectiveList::checkDynamic(SourceListDirective* directive) const {
   return !directive || directive->allowDynamic();
 }
 
 void CSPDirectiveList::reportMixedContent(
     const KURL& mixedURL,
     ResourceRequest::RedirectStatus redirectStatus) const {
-  if (strictMixedContentChecking())
+  if (strictMixedContentChecking()) {
     m_policy->reportViolation(ContentSecurityPolicy::BlockAllMixedContent,
                               ContentSecurityPolicy::BlockAllMixedContent,
                               String(), mixedURL, m_reportEndpoints, m_header,
-                              ContentSecurityPolicy::URLViolation, nullptr,
-                              redirectStatus);
+                              m_headerType, ContentSecurityPolicy::URLViolation,
+                              nullptr, redirectStatus);
+  }
 }
 
 bool CSPDirectiveList::checkSource(
     SourceListDirective* directive,
     const KURL& url,
     ResourceRequest::RedirectStatus redirectStatus) const {
   // If |url| is empty, fall back to the policy URL to ensure that <object>'s
   // without a `src` can be blocked/allowed, as they can still load plugins
   // even though they don't actually have a URL.
   return !directive ||
@@ skipping 1025 matching lines @@
   visitor->trace(m_frameSrc);
   visitor->trace(m_imgSrc);
   visitor->trace(m_mediaSrc);
   visitor->trace(m_manifestSrc);
   visitor->trace(m_objectSrc);
   visitor->trace(m_scriptSrc);
   visitor->trace(m_styleSrc);
 }
 
 }  // namespace blink