PlzNavigate: Do not disclose urls between cross-origin renderers.

content/common/content_security_policy/content_security_policy.cc

 // Copyright 2017 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <sstream>
 #include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
 #include "content/common/content_security_policy/csp_context.h"
 
 namespace content {
@@ skipping 32 matching lines @@
                      const CSPDirective::Name directive_name,
                      const GURL& url,
                      bool is_redirect,
                      const SourceLocation& source_location) {
   // We should never have a violation against `child-src` or `default-src`
   // directly; the effective directive should always be one of the explicit
   // fetch directives.
   DCHECK_NE(directive_name, CSPDirective::DefaultSrc);
   DCHECK_NE(directive_name, CSPDirective::ChildSrc);
 
+  // For security reasons, some urls must not be disclosed. It includes the

[alexmos, 2017/05/16 05:56:49]

nit: It includes -> This includes  (also below)

[arthursonzogni, 2017/05/16 12:48:44]

Done.

+  // blocked url and the source location of the error. Care must be taken to
+  // ensure that these are not transmitted between different cross-origin
+  // renderers.
+  GURL safe_url = url;
+  SourceLocation safe_source_location = source_location;
+  context->SanitizeDataForUseInCspViolation(&safe_url, &safe_source_location,
+                                            is_redirect, directive_name);
+
   std::stringstream message;
 
   if (policy.header.type == blink::kWebContentSecurityPolicyTypeReport)
     message << "[Report Only] ";
 
   if (directive_name == CSPDirective::FormAction)
     message << "Refused to send form data to '";
   else if (directive_name == CSPDirective::FrameSrc)
     message << "Refused to frame '";
 
-  message << ElideURLForReportViolation(url)
+  message << ElideURLForReportViolation(safe_url)
           << "' because it violates the following Content Security Policy "
              "directive: \""
           << directive.ToString() << "\".";
 
   if (directive.name != directive_name)
     message << " Note that '" << CSPDirective::NameToString(directive_name)
             << "' was not explicitly set, so '"
             << CSPDirective::NameToString(directive.name)
             << "' is used as a fallback.";
 
   message << "\n";
 
   context->ReportContentSecurityPolicyViolation(CSPViolationParams(
       CSPDirective::NameToString(directive.name),
-      CSPDirective::NameToString(directive_name), message.str(), url,
+      CSPDirective::NameToString(directive_name), message.str(), safe_url,
       policy.report_endpoints, policy.header.header_value, policy.header.type,
-      is_redirect, source_location));
+      is_redirect, safe_source_location));
 }
 
 bool AllowDirective(CSPContext* context,
                     const ContentSecurityPolicy& policy,
                     const CSPDirective& directive,
                     CSPDirective::Name directive_name,
                     const GURL& url,
                     bool is_redirect,
                     const SourceLocation& source_location) {
   if (CSPSourceList::Allow(directive.source_list, url, context, is_redirect))
@@ skipping 80 matching lines @@
     is_first_policy = false;
     text << "report-uri";
     for (const std::string& endpoint : report_endpoints)
       text << " " << endpoint;
   }
 
   return text.str();
 }
 
 }  // namespace content