CSP: Fire 'SecurityPolicyViolation' on the offending element.

third_party/WebKit/Source/core/dom/Document.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2012 Apple Inc. All
  * rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved.
@@ skipping 5375 matching lines @@
 
 bool Document::isSecureTransitionTo(const KURL& url) const {
   RefPtr<SecurityOrigin> other = SecurityOrigin::create(url);
   return getSecurityOrigin()->canAccess(other.get());
 }
 
 bool Document::allowInlineEventHandler(Node* node,
                                        EventListener* listener,
                                        const String& contextURL,
                                        const WTF::OrdinalNumber& contextLine) {
+  Element* element = node && node->isElementNode() ? toElement(node) : nullptr;
   if (!ContentSecurityPolicy::shouldBypassMainWorld(this) &&
       !contentSecurityPolicy()->allowInlineEventHandler(
-          listener->code(), contextURL, contextLine))
+          element, listener->code(), contextURL, contextLine))
     return false;
 
   // HTML says that inline script needs browsing context to create its execution
   // environment.
   // http://www.whatwg.org/specs/web-apps/current-work/multipage/webappapis.html#event-handler-attributes
   // Also, if the listening node came from other document, which happens on
   // context-less event dispatching, we also need to ask the owner document of
   // the node.
   LocalFrame* frame = executingFrame();
   if (!frame)
@@ skipping 991 matching lines @@
 }
 
 void showLiveDocumentInstances() {
   WeakDocumentSet& set = liveDocumentSet();
   fprintf(stderr, "There are %u documents currently alive:\n", set.size());
   for (Document* document : set)
     fprintf(stderr, "- Document %p URL: %s\n", document,
             document->url().getString().utf8().data());
 }
 #endif