CSP: Don't override the location set in reportViolationWithLocation.

third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPDirectiveList.h"
 
 #include "bindings/core/v8/SourceLocation.h"
 #include "core/dom/Document.h"
 #include "core/dom/SecurityContext.h"
 #include "core/dom/SpaceSplitString.h"
@@ skipping 81 matching lines @@
     const ContentSecurityPolicy::DirectiveType& effectiveType,
     const String& consoleMessage,
     const KURL& blockedURL,
     ResourceRequest::RedirectStatus redirectStatus) const {
   String message =
       isReportOnly() ? "[Report Only] " + consoleMessage : consoleMessage;
   m_policy->logToConsole(ConsoleMessage::create(SecurityMessageSource,
                                                 ErrorMessageLevel, message));
   m_policy->reportViolation(directiveText, effectiveType, message, blockedURL,
                             m_reportEndpoints, m_header, m_headerType,
-                            ContentSecurityPolicy::URLViolation, nullptr,
+                            ContentSecurityPolicy::URLViolation,
+                            std::unique_ptr<SourceLocation>(),
+                            nullptr,  // localFrame
                             redirectStatus);
 }
 
 void CSPDirectiveList::reportViolationWithFrame(
     const String& directiveText,
     const ContentSecurityPolicy::DirectiveType& effectiveType,
     const String& consoleMessage,
     const KURL& blockedURL,
     LocalFrame* frame) const {
   String message =
       isReportOnly() ? "[Report Only] " + consoleMessage : consoleMessage;
   m_policy->logToConsole(
       ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel, message),
       frame);
   m_policy->reportViolation(directiveText, effectiveType, message, blockedURL,
                             m_reportEndpoints, m_header, m_headerType,
-                            ContentSecurityPolicy::URLViolation, frame);
+                            ContentSecurityPolicy::URLViolation,
+                            std::unique_ptr<SourceLocation>(), frame);
 }
 
 void CSPDirectiveList::reportViolationWithLocation(
     const String& directiveText,
     const ContentSecurityPolicy::DirectiveType& effectiveType,
     const String& consoleMessage,
     const KURL& blockedURL,
     const String& contextURL,
     const WTF::OrdinalNumber& contextLine,
     Element* element,
     const String& source) const {
   String message =
       isReportOnly() ? "[Report Only] " + consoleMessage : consoleMessage;
-  m_policy->logToConsole(ConsoleMessage::create(
-      SecurityMessageSource, ErrorMessageLevel, message,
-      SourceLocation::capture(contextURL, contextLine.oneBasedInt(), 0)));
-  m_policy->reportViolation(
-      directiveText, effectiveType, message, blockedURL, m_reportEndpoints,
-      m_header, m_headerType, ContentSecurityPolicy::InlineViolation, nullptr,
-      RedirectStatus::NoRedirect, contextLine.oneBasedInt(), element, source);
+  std::unique_ptr<SourceLocation> sourceLocation =
+      SourceLocation::capture(contextURL, contextLine.oneBasedInt(), 0);
+  m_policy->logToConsole(ConsoleMessage::create(SecurityMessageSource,
+                                                ErrorMessageLevel, message,
+                                                sourceLocation->clone()));
+  m_policy->reportViolation(directiveText, effectiveType, message, blockedURL,
+                            m_reportEndpoints, m_header, m_headerType,
+                            ContentSecurityPolicy::InlineViolation,
+                            std::move(sourceLocation), nullptr,  // localFrame
+                            RedirectStatus::NoRedirect, element, source);
 }
 
 void CSPDirectiveList::reportViolationWithState(
     const String& directiveText,
     const ContentSecurityPolicy::DirectiveType& effectiveType,
     const String& message,
     const KURL& blockedURL,
     ScriptState* scriptState,
     const ContentSecurityPolicy::ExceptionStatus exceptionStatus) const {
   String reportMessage = isReportOnly() ? "[Report Only] " + message : message;
   // Print a console message if it won't be redundant with a
   // JavaScript exception that the caller will throw. (Exceptions will
   // never get thrown in report-only mode because the caller won't see
   // a violation.)
   if (isReportOnly() ||
       exceptionStatus == ContentSecurityPolicy::WillNotThrowException) {
     ConsoleMessage* consoleMessage = ConsoleMessage::create(
         SecurityMessageSource, ErrorMessageLevel, reportMessage);
     m_policy->logToConsole(consoleMessage);
   }
   m_policy->reportViolation(directiveText, effectiveType, message, blockedURL,
                             m_reportEndpoints, m_header, m_headerType,
-                            ContentSecurityPolicy::EvalViolation);
+                            ContentSecurityPolicy::EvalViolation,
+                            std::unique_ptr<SourceLocation>());
 }
 
 bool CSPDirectiveList::checkEval(SourceListDirective* directive) const {
   return !directive || directive->allowEval();
 }
 
 bool CSPDirectiveList::isMatchingNoncePresent(SourceListDirective* directive,
                                               const String& nonce) const {
   return directive && directive->allowNonce(nonce);
 }
@@ skipping 14 matching lines @@
 
 void CSPDirectiveList::reportMixedContent(
     const KURL& mixedURL,
     ResourceRequest::RedirectStatus redirectStatus) const {
   if (strictMixedContentChecking()) {
     m_policy->reportViolation(
         ContentSecurityPolicy::getDirectiveName(
             ContentSecurityPolicy::DirectiveType::BlockAllMixedContent),
         ContentSecurityPolicy::DirectiveType::BlockAllMixedContent, String(),
         mixedURL, m_reportEndpoints, m_header, m_headerType,
-        ContentSecurityPolicy::URLViolation, nullptr, redirectStatus);
+        ContentSecurityPolicy::URLViolation, std::unique_ptr<SourceLocation>(),
+        nullptr,  // contextFrame,
+        redirectStatus);
   }
 }
 
 bool CSPDirectiveList::checkSource(
     SourceListDirective* directive,
     const KURL& url,
     ResourceRequest::RedirectStatus redirectStatus) const {
   // If |url| is empty, fall back to the policy URL to ensure that <object>'s
   // without a `src` can be blocked/allowed, as they can still load plugins
   // even though they don't actually have a URL.
@@ skipping 1146 matching lines @@
   visitor->trace(m_imgSrc);
   visitor->trace(m_mediaSrc);
   visitor->trace(m_manifestSrc);
   visitor->trace(m_objectSrc);
   visitor->trace(m_scriptSrc);
   visitor->trace(m_styleSrc);
   visitor->trace(m_workerSrc);
 }
 
 }  // namespace blink