Upgrade-Insecure-Requests: Split CSP checks into pre-upgrade and post-upgrade.

third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp

 /*
     Copyright (C) 1998 Lars Knoll (knoll@mpi-hd.mpg.de)
     Copyright (C) 2001 Dirk Mueller (mueller@kde.org)
     Copyright (C) 2002 Waldo Bastian (bastian@kde.org)
     Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All
     rights reserved.
     Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ skipping 22 matching lines @@
 #include "core/fetch/FetchInitiatorTypeNames.h"
 #include "core/fetch/ImageResource.h"
 #include "core/fetch/MemoryCache.h"
 #include "core/fetch/ResourceLoader.h"
 #include "core/fetch/ResourceLoadingLog.h"
 #include "core/fetch/UniqueIdentifier.h"
 #include "platform/Histogram.h"
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/mhtml/ArchiveResource.h"
 #include "platform/mhtml/MHTMLArchive.h"
+#include "platform/network/ContentSecurityPolicyParsers.h"
 #include "platform/network/NetworkInstrumentation.h"
 #include "platform/network/NetworkUtils.h"
 #include "platform/network/ResourceTimingInfo.h"
 #include "platform/tracing/TraceEvent.h"
 #include "platform/tracing/TracedValue.h"
 #include "platform/weborigin/KnownPorts.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include "platform/weborigin/SecurityPolicy.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebCachePolicy.h"
@@ skipping 435 matching lines @@
     const SubstituteData& substituteData) {
   unsigned long identifier = createUniqueIdentifier();
   network_instrumentation::ScopedResourceLoadTracker scopedResourceLoadTracker(
       identifier, request.resourceRequest());
   SCOPED_BLINK_UMA_HISTOGRAM_TIMER("Blink.Fetch.RequestResourceTime");
   DCHECK(request.options().synchronousPolicy == RequestAsynchronously ||
          factory.type() == Resource::Raw ||
          factory.type() == Resource::XSLStyleSheet);
 
   context().populateRequestData(request.mutableResourceRequest());
+
+  // It's important that we check the request against the page's CSP _before_
+  // modifying it via upgrade-insecure-requests, etc. Otherwise, developers
+  // won't get error reports for upgraded resources.
+  context().checkCSPForRequest(
+      request.resourceRequest(),
+      MemoryCache::removeFragmentIdentifierIfNeeded(request.url()),
+      request.options(), request.forPreload(),
+      request.resourceRequest().redirectStatus(),
+      ContentSecurityPolicyHeaderTypeReport);
   context().modifyRequestForCSP(request.mutableResourceRequest());
   context().addClientHintsIfNecessary(request);
   context().addCSPHeaderIfNecessary(factory.type(), request);
 
   // TODO(dproy): Remove this. http://crbug.com/659666
   TRACE_EVENT1("blink", "ResourceFetcher::requestResource", "url",
                urlForTraceEvent(request.url()));
 
   if (!request.url().isValid())
     return nullptr;
@@ skipping 853 matching lines @@
   return request.fetchRedirectMode() ==
              WebURLRequest::FetchRedirectModeManual &&
          request.requestContext() == WebURLRequest::RequestContextFetch;
 }
 
 bool ResourceFetcher::willFollowRedirect(
     Resource* resource,
     ResourceRequest& newRequest,
     const ResourceResponse& redirectResponse) {
   if (!isManualRedirectFetchRequest(resource->resourceRequest())) {
+    // TODO(mkwst):
     if (!context().canRequest(resource->getType(), newRequest, newRequest.url(),
                               resource->options(), resource->isUnusedPreload(),
                               FetchRequest::UseDefaultOriginRestrictionForType))
       return false;
     if (resource->options().corsEnabled == IsCORSEnabled) {
       RefPtr<SecurityOrigin> sourceOrigin = resource->options().securityOrigin;
       if (!sourceOrigin.get())
         sourceOrigin = context().getSecurityOrigin();
 
       String errorMessage;
@@ skipping 257 matching lines @@
   visitor->trace(m_context);
   visitor->trace(m_archive);
   visitor->trace(m_loaders);
   visitor->trace(m_nonBlockingLoaders);
   visitor->trace(m_documentResources);
   visitor->trace(m_preloads);
   visitor->trace(m_resourceTimingInfoMap);
 }
 
 }  // namespace blink