CSP: Add 'script-sample' to violation reports.

third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp

Index: third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp
diff --git a/third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp b/third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp
index eb6c5d4f38a78873680b374a1ad6a6bc55f1b461..e0ef36e9e041880d3d7d7207a531128c75bb24e3 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp
@@ -252,12 +252,16 @@ bool ScriptController::executeScriptIfJavaScriptURL(const KURL& url,
   if (!url.protocolIsJavaScript())
     return false;
 
+  const int javascriptSchemeLength = sizeof("javascript:") - 1;
+  String scriptSource = decodeURLEscapeSequences(url.getString())
+                            .substring(javascriptSchemeLength);
+
   bool shouldBypassMainWorldContentSecurityPolicy =
       ContentSecurityPolicy::shouldBypassMainWorld(frame()->document());
   if (!frame()->page() ||
       (!shouldBypassMainWorldContentSecurityPolicy &&
        !frame()->document()->contentSecurityPolicy()->allowJavaScriptURLs(
-           element, frame()->document()->url(),
+           element, scriptSource, frame()->document()->url(),
            eventHandlerPosition().m_line))) {
     return true;
   }
@@ -270,16 +274,13 @@ bool ScriptController::executeScriptIfJavaScriptURL(const KURL& url,
 
   Document* ownerDocument = frame()->document();
 
-  const int javascriptSchemeLength = sizeof("javascript:") - 1;
-
   bool locationChangeBefore =
       frame()->navigationScheduler().locationChangePending();
 
-  String decodedURL = decodeURLEscapeSequences(url.getString());
   v8::HandleScope handleScope(isolate());
   v8::Local<v8::Value> result = evaluateScriptInMainWorld(
-      ScriptSourceCode(decodedURL.substring(javascriptSchemeLength)),
-      NotSharableCrossOrigin, DoNotExecuteScriptWhenScriptsDisabled);
+      ScriptSourceCode(scriptSource), NotSharableCrossOrigin,
+      DoNotExecuteScriptWhenScriptsDisabled);
 
   // If executing script caused this frame to be removed from the page, we
   // don't want to try to replace its document!