CSP: Strip the fragment from reported URLs.

third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp

Index: third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp
diff --git a/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp b/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp
index 94b4a054dde9c8527e4c2f3cafc3af6e67a523d6..fbc7a8bf2f08ae45b329b5351a6cb60390941ecf 100644
--- a/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp
+++ b/third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp
@@ -1026,10 +1026,10 @@ static void gatherSecurityPolicyViolationEventData(
     // If this load was blocked via 'frame-ancestors', then the URL of
     // |document| has not yet been initialized. In this case, we'll set both
     // 'documentURI' and 'blockedURI' to the blocked document's URL.
-    init.setDocumentURI(blockedURL.getString());
-    init.setBlockedURI(blockedURL.getString());
+    init.setDocumentURI(blockedURL.strippedForUseAsReferrer());

[elawrence, 2017/01/09 16:34:41]

In the stripURLForUseInReport() function immediately prior, we note

// 'KURL::strippedForUseAsReferrer()' dumps 'String()' for non-webby URLs.
// It's better for developers if we return the origin of those URLs rather than
nothing.

I don't know if that concern applies here?

[Mike West, 2017/02/23 08:41:19]

For the `document-uri`, that's less of a concern, as it's quite difficult to
load any non-webby URL in the content area of Chrome. It would make reports from
`ftp:`, `chrome:`, and `chrome-extension:` URLs less useful, but we also don't
actually send reports for those URLs (as there are no headers, and therefore no
ability to set `report-uri` in the policy).

Still, it's worth being consistent. I'll adjust. :)

+    init.setBlockedURI(blockedURL.strippedForUseAsReferrer());
   } else {
-    init.setDocumentURI(context->url().getString());
+    init.setDocumentURI(context->url().strippedForUseAsReferrer());
     switch (violationType) {
       case ContentSecurityPolicy::InlineViolation:
         init.setBlockedURI("inline");