Network traffic annotation added to URLFetcher.

net/url_request/report_sender.cc

Index: net/url_request/report_sender.cc
diff --git a/net/url_request/report_sender.cc b/net/url_request/report_sender.cc
index ef560151d01f26473698a5c536c4808977316d3d..fa1ad45e8ff1f04a08be9607e331d8f02a48efd9 100644
--- a/net/url_request/report_sender.cc
+++ b/net/url_request/report_sender.cc
@@ -11,6 +11,7 @@
 #include "net/base/load_flags.h"
 #include "net/base/request_priority.h"
 #include "net/base/upload_bytes_element_reader.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_status.h"
 
@@ -54,8 +55,29 @@ void ReportSender::Send(const GURL& report_uri,
                         const SuccessCallback& success_callback,
                         const ErrorCallback& error_callback) {
   DCHECK(!content_type.empty());
-  std::unique_ptr<URLRequest> url_request =
-      request_context_->CreateRequest(report_uri, DEFAULT_PRIORITY, this);
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("...", R"(
+        semantics {
+          sender: "..."
+          description: "..."
+          trigger: "..."
+          data: "..."
+          destination: WEBSITE/GOOGLE_OWNED_SERVICE/OTHER/LOCAL
+        }
+        policy {
+          cookies_allowed: false/true
+          cookies_store: "..."
+          setting: "..."
+          chrome_policy {
+            [POLICY_NAME] {
+              policy_options {mode: MANDATORY/RECOMMENDED/UNSET}
+              [POLICY_NAME]: ... //(value to disable it)
+            }
+          }
+          policy_exception_justification: "..."
+        })");
+  std::unique_ptr<URLRequest> url_request = request_context_->CreateRequest(
+      report_uri, DEFAULT_PRIORITY, this, traffic_annotation);

[meacer, 2017/04/27 17:55:28]

* sender: "Safe Browsing Extended Reporting"

However I'm not sure if SBER is the only user. estark: Do pinning failures also
use SBER?

* description: "Sends an anonymous report to a Google server about security
issues".

Or we can point them to the whitepaper:
https://www.google.com/chrome/browser/privacy/whitepaper.html?hl=en-US#extend...

* trigger: "A request can be sent when an SSL certificate error is encountered
or SafeBrowsing detects a threat on a website"

* data: "For SSL reports: the certificate that caused the error, hostname, user
agent, et.c. For SafeBrowsing reports, .... For more information, see
https://www.google.com/chrome/browser/privacy/whitepaper.html?hl=en-US#extend...

* destination: GOOGLE_OWNED_SERVICE

* cookies_allowed: false
Needs to be confirmed: https://crbug.com/716098

* setting: "Users can disable these requests by unchecking 'Automatically report
details of possible security incidents to Google' in the settings page or on SSL
and SafeBrowsing error pages"

* policy_exception_justification: "Not implemented"

Not sure about this. estark, jialiul: Can you please confirm?

[Jialiu Lin, 2017/04/27 18:04:53]

I think the annotation should be added to each of its sub-classes. ReportSender
is just a base class. It will be super confusing to elaborate on each case here.

[estark, 2017/04/28 05:18:28]

Yeah, I agree with Jialiu that it's infeasible to document every user of this
class. net/ doesn't know anything about Safe Browsing, for example; it breaks
layering to have it documented here.

   url_request->SetUserData(
       &kUserDataKey,
       base::MakeUnique<CallbackInfo>(success_callback, error_callback));