CSP: Add 'script-sample' to violation reports.

third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPDirectiveList.h"
 
 #include "bindings/core/v8/SourceLocation.h"
 #include "core/dom/Document.h"
 #include "core/dom/SecurityContext.h"
 #include "core/dom/SpaceSplitString.h"
@@ skipping 106 matching lines @@
                             ContentSecurityPolicy::URLViolation, frame);
 }
 
 void CSPDirectiveList::reportViolationWithLocation(
     const String& directiveText,
     const ContentSecurityPolicy::DirectiveType& effectiveType,
     const String& consoleMessage,
     const KURL& blockedURL,
     const String& contextURL,
     const WTF::OrdinalNumber& contextLine,
-    Element* element) const {
+    Element* element,
+    const String& source) const {
   String message =
       isReportOnly() ? "[Report Only] " + consoleMessage : consoleMessage;
   m_policy->logToConsole(ConsoleMessage::create(
       SecurityMessageSource, ErrorMessageLevel, message,
       SourceLocation::capture(contextURL, contextLine.oneBasedInt(), 0)));
   m_policy->reportViolation(
       directiveText, effectiveType, message, blockedURL, m_reportEndpoints,
       m_header, m_headerType, ContentSecurityPolicy::InlineViolation, nullptr,
-      RedirectStatus::NoRedirect, contextLine.oneBasedInt(), element);
+      RedirectStatus::NoRedirect, contextLine.oneBasedInt(), element, source);
 }
 
 void CSPDirectiveList::reportViolationWithState(
     const String& directiveText,
     const ContentSecurityPolicy::DirectiveType& effectiveType,
     const String& message,
     const KURL& blockedURL,
     ScriptState* scriptState,
     const ContentSecurityPolicy::ExceptionStatus exceptionStatus) const {
   String reportMessage = isReportOnly() ? "[Report Only] " + message : message;
@@ skipping 222 matching lines @@
   reportViolation(
       directive->text(), ContentSecurityPolicy::DirectiveType::PluginTypes,
       message + "\n", KURL(), ResourceRequest::RedirectStatus::NoRedirect);
   return denyIfEnforcingPolicy();
 }
 
 bool CSPDirectiveList::checkInlineAndReportViolation(
     SourceListDirective* directive,
     const String& consoleMessage,
     Element* element,
+    const String& source,
     const String& contextURL,
     const WTF::OrdinalNumber& contextLine,
     bool isScript,
     const String& hashValue) const {
   if (!directive || directive->allowAllInline())
     return true;
 
   String suffix = String();
   if (directive->allowInline() && directive->isHashOrNoncePresent()) {
     // If inline is allowed, but a hash or nonce is present, we ignore
@@ skipping 10 matching lines @@
                String(isScript ? "script" : "style") +
                "-src' was not explicitly set, so 'default-src' is used as a "
                "fallback.";
   }
 
   reportViolationWithLocation(
       directive->text(),
       isScript ? ContentSecurityPolicy::DirectiveType::ScriptSrc
                : ContentSecurityPolicy::DirectiveType::StyleSrc,
       consoleMessage + "\"" + directive->text() + "\"." + suffix + "\n", KURL(),
-      contextURL, contextLine, element);
+      contextURL, contextLine, element,
+      directive->allowReportSample() ? source : emptyString);

[andypaicu, 2017/02/22 12:47:03]

Minor nit: perhaps we can start passing from here the already sanitized and
trimmed sample. Skips having to check for experimental features twice.

[Mike West, 2017/02/22 14:54:00]

I'd prefer to keep the sanitization bits in `::reportViolation` (and it's
helpers), as that means we don't have to rely on all the callsites to do the
right thing. Also, doing it in `::reportViolation` means that we don't spend the
time/memory on copying the string unless we actually need to deliver it (because
we can pass it by reference here).

 
   if (!isReportOnly()) {
     if (isScript)
       m_policy->reportBlockedScriptExecutionToInspector(directive->text());
     return false;
   }
   return true;
 }
 
 bool CSPDirectiveList::checkSourceAndReportViolation(
@@ skipping 76 matching lines @@
                                "' in a frame because an ancestor violates the "
                                "following Content Security Policy directive: "
                                "\"" +
                                directive->text() + "\".",
                            url, frame);
   return denyIfEnforcingPolicy();
 }
 
 bool CSPDirectiveList::allowJavaScriptURLs(
     Element* element,
+    const String& source,
     const String& contextURL,
     const WTF::OrdinalNumber& contextLine,
     ContentSecurityPolicy::ReportingStatus reportingStatus) const {
   SourceListDirective* directive = operativeDirective(m_scriptSrc.get());
   if (reportingStatus == ContentSecurityPolicy::SendReport) {
     return checkInlineAndReportViolation(
         directive,
         "Refused to execute JavaScript URL because it violates the following "
         "Content Security Policy directive: ",
-        element, contextURL, contextLine, true, "sha256-...");
+        element, source, contextURL, contextLine, true, "sha256-...");
   }
 
   return !directive || directive->allowAllInline();
 }
 
 bool CSPDirectiveList::allowInlineEventHandlers(
     Element* element,
+    const String& source,
     const String& contextURL,
     const WTF::OrdinalNumber& contextLine,
     ContentSecurityPolicy::ReportingStatus reportingStatus) const {
   SourceListDirective* directive = operativeDirective(m_scriptSrc.get());
   if (reportingStatus == ContentSecurityPolicy::SendReport) {
     return checkInlineAndReportViolation(
         operativeDirective(m_scriptSrc.get()),
         "Refused to execute inline event handler because it violates the "
         "following Content Security Policy directive: ",
-        element, contextURL, contextLine, true, "sha256-...");
+        element, source, contextURL, contextLine, true, "sha256-...");
   }
 
   return !directive || directive->allowAllInline();
 }
 
 bool CSPDirectiveList::allowInlineScript(
     Element* element,
     const String& contextURL,
     const String& nonce,
     const WTF::OrdinalNumber& contextLine,
     ContentSecurityPolicy::ReportingStatus reportingStatus,
     const String& content) const {
   SourceListDirective* directive = operativeDirective(m_scriptSrc.get());
   if (isMatchingNoncePresent(directive, nonce))
     return true;
   if (element && isHTMLScriptElement(element) &&
       !toHTMLScriptElement(element)->loader()->isParserInserted() &&
       allowDynamic()) {
     return true;
   }
   if (reportingStatus == ContentSecurityPolicy::SendReport) {
     return checkInlineAndReportViolation(
         directive,
         "Refused to execute inline script because it violates the following "
         "Content Security Policy directive: ",
-        element, contextURL, contextLine, true, getSha256String(content));
+        element, content, contextURL, contextLine, true,
+        getSha256String(content));
   }
 
   return !directive || directive->allowAllInline();
 }
 
 bool CSPDirectiveList::allowInlineStyle(
     Element* element,
     const String& contextURL,
     const String& nonce,
     const WTF::OrdinalNumber& contextLine,
     ContentSecurityPolicy::ReportingStatus reportingStatus,
     const String& content) const {
   SourceListDirective* directive = operativeDirective(m_styleSrc.get());
   if (isMatchingNoncePresent(directive, nonce))
     return true;
   if (reportingStatus == ContentSecurityPolicy::SendReport) {
     return checkInlineAndReportViolation(
         directive,
         "Refused to apply inline style because it violates the following "
         "Content Security Policy directive: ",
-        element, contextURL, contextLine, false, getSha256String(content));
+        element, String(), contextURL, contextLine, false,
+        getSha256String(content));
   }
 
   return !directive || directive->allowAllInline();
 }
 
 bool CSPDirectiveList::allowEval(
     ScriptState* scriptState,
     ContentSecurityPolicy::ReportingStatus reportingStatus,
     ContentSecurityPolicy::ExceptionStatus exceptionStatus) const {
   if (reportingStatus == ContentSecurityPolicy::SendReport) {
@@ skipping 733 matching lines @@
   visitor->trace(m_imgSrc);
   visitor->trace(m_mediaSrc);
   visitor->trace(m_manifestSrc);
   visitor->trace(m_objectSrc);
   visitor->trace(m_scriptSrc);
   visitor->trace(m_styleSrc);
   visitor->trace(m_workerSrc);
 }
 
 }  // namespace blink