PlzNavigate & CSP. Use the SourceLocation in violation reports.

content/common/content_security_policy/csp_context.h

 // Copyright 2017 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_COMMON_CONTENT_SECURITY_POLICY_CSP_CONTEXT_H_
 #define CONTENT_COMMON_CONTENT_SECURITY_POLICY_CSP_CONTEXT_H_
 
 #include <vector>
 
 #include "content/common/content_export.h"
 #include "content/common/content_security_policy/content_security_policy.h"
 #include "content/common/content_security_policy_header.h"
+#include "content/common/navigation_params.h"
 #include "url/gurl.h"
 #include "url/origin.h"
 
 namespace content {
 
 struct CSPViolationParams;
 
 // A CSPContext represents the system on which the Content-Security-Policy are
-// enforced. One must define via its virtual methods how to report violations,
-// how to log messages on the console and what is the set of scheme that bypass
-// the CSP. Its main implementation is in
-// content/browser/frame_host/render_frame_host_impl.h
+// enforced. One must define via its virtual methods how to report violations
+// and what is the set of scheme that bypasses the CSP. Its main implementation

[alexmos, 2017/03/29 23:27:32]

nit: "set of schemes that bypass the CSP"

[arthursonzogni, 2017/03/30 11:36:27]

Done.

+// is in content/browser/frame_host/render_frame_host_impl.h
 class CONTENT_EXPORT CSPContext {
  public:
   CSPContext();
   virtual ~CSPContext();
 
+  // Check if an |url| is allowed by the set of Content-Security-Policy. It will
+  // report any violation by:
+  // * displaying a console message.
+  // * triggering the "SecurityPolicyViolation" javascript event.
+  // * sending a JSON report to any uri defined with the "report-uri" directive.
+  // Returns true when the request can proceed, false otherwise.
   bool IsAllowedByCsp(CSPDirective::Name directive_name,
                       const GURL& url,
-                      bool is_redirect = false);
+                      bool is_redirect,
+                      const SourceLocation& source_location);
 
   void SetSelf(const url::Origin origin);
   bool AllowSelf(const GURL& url);
   bool ProtocolMatchesSelf(const GURL& url);
 
-  virtual void LogToConsole(const std::string& message);
   virtual void ReportContentSecurityPolicyViolation(
       const CSPViolationParams& violation_params);
 
   bool SelfSchemeShouldBypassCsp();
 
   void ResetContentSecurityPolicies() { policies_.clear(); }
   void AddContentSecurityPolicy(const ContentSecurityPolicy& policy) {
     policies_.push_back(policy);
   }
 
@@ skipping 12 matching lines @@
 // Used in CSPContext::ReportViolation()
 struct CONTENT_EXPORT CSPViolationParams {
   CSPViolationParams();
   CSPViolationParams(const std::string& directive,
                      const std::string& effective_directive,
                      const std::string& console_message,
                      const GURL& blocked_url,
                      const std::vector<std::string>& report_endpoints,
                      const std::string& header,
                      const blink::WebContentSecurityPolicyType& disposition,
-                     bool after_redirect);
+                     bool after_redirect,
+                     const SourceLocation& source_location);
   CSPViolationParams(const CSPViolationParams& other);
   ~CSPViolationParams();
 
   // The name of the directive that violates the policy. |directive| might be a
   // directive that serves as a fallback to the |effective_directive|.
   std::string directive;
 
   // The name the effective directive that was checked against.
   std::string effective_directive;
 
   // The console message to be displayed to the user.
   std::string console_message;
 
   // The URL that was blocked by the policy.
   GURL blocked_url;
 
   // The set of URI where a JSON-formatted report of the violation should be
   // sent.
   std::vector<std::string> report_endpoints;
 
   // The raw content security policy header that was violated.
   std::string header;
 
   // Each policy has an associated disposition, which is either "enforce" or
   // "report".
   blink::WebContentSecurityPolicyType disposition;
 
   // Whether or not the violation happens after a redirect.
   bool after_redirect;
+
+  // The source code location that triggered the blocked navigation.
+  SourceLocation source_location;
 };
 
 }  // namespace content
 #endif  // CONTENT_COMMON_CONTENT_SECURITY_POLICY_CSP_CONTEXT_H_