CSP: Fire 'SecurityPolicyViolation' on the offending element.

third_party/WebKit/Source/core/dom/StyleElement.cpp

 /*
  * Copyright (C) 2006, 2007 Rob Buis
  * Copyright (C) 2008 Apple, Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 141 matching lines @@
 
 StyleElement::ProcessingResult StyleElement::createSheet(Element& element,
                                                          const String& text) {
   DCHECK(element.isConnected());
   Document& document = element.document();
 
   const ContentSecurityPolicy* csp = document.contentSecurityPolicy();
   bool passesContentSecurityPolicyChecks =
       shouldBypassMainWorldCSP(element) ||
       csp->allowStyleWithHash(text, ContentSecurityPolicy::InlineType::Block) ||
-      csp->allowInlineStyle(document.url(),
+      csp->allowInlineStyle(&element, document.url(),
                             element.fastGetAttribute(HTMLNames::nonceAttr),
                             m_startPosition.m_line, text);
 
   // Clearing the current sheet may remove the cache entry so create the new
   // sheet first
   CSSStyleSheet* newSheet = nullptr;
 
   // If type is empty or CSS, this is a CSS style sheet.
   const AtomicString& type = this->type();
   if (isCSS(element, type) && passesContentSecurityPolicyChecks) {
@@ skipping 42 matching lines @@
 
 void StyleElement::startLoadingDynamicSheet(Document& document) {
   document.styleEngine().addPendingSheet(m_styleEngineContext);
 }
 
 DEFINE_TRACE(StyleElement) {
   visitor->trace(m_sheet);
 }
 
 }  // namespace blink