Upgrade-Insecure-Requests: Split CSP checks into pre-upgrade and post-upgrade.

third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp

Index: third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp
diff --git a/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp b/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp
index cb7b2cccaaab98ed31825e0f51f7e26352b45a12..384cbaaab7d4f209ba24e82c4ca5f98c44e57871 100644
--- a/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp
+++ b/third_party/WebKit/Source/core/fetch/ResourceFetcher.cpp
@@ -40,6 +40,7 @@
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/mhtml/ArchiveResource.h"
 #include "platform/mhtml/MHTMLArchive.h"
+#include "platform/network/ContentSecurityPolicyParsers.h"
 #include "platform/network/NetworkInstrumentation.h"
 #include "platform/network/NetworkUtils.h"
 #include "platform/network/ResourceTimingInfo.h"
@@ -495,6 +496,16 @@ Resource* ResourceFetcher::requestResource(
          factory.type() == Resource::XSLStyleSheet);
 
   context().populateRequestData(request.mutableResourceRequest());
+
+  // It's important that we check the request against the page's CSP _before_
+  // modifying it via upgrade-insecure-requests, etc. Otherwise, developers
+  // won't get error reports for upgraded resources.
+  context().checkCSPForRequest(
+      request.resourceRequest(),
+      MemoryCache::removeFragmentIdentifierIfNeeded(request.url()),
+      request.options(), request.forPreload(),
+      request.resourceRequest().redirectStatus(),
+      ContentSecurityPolicyHeaderTypeReport);
   context().modifyRequestForCSP(request.mutableResourceRequest());
   context().addClientHintsIfNecessary(request);
   context().addCSPHeaderIfNecessary(factory.type(), request);
@@ -1368,6 +1379,7 @@ bool ResourceFetcher::willFollowRedirect(
     ResourceRequest& newRequest,
     const ResourceResponse& redirectResponse) {
   if (!isManualRedirectFetchRequest(resource->resourceRequest())) {
+    // TODO(mkwst):
     if (!context().canRequest(resource->getType(), newRequest, newRequest.url(),
                               resource->options(), resource->isUnusedPreload(),
                               FetchRequest::UseDefaultOriginRestrictionForType))