CSP: Measure the frequency of `postMessage` violating `connect-src`

CSP: Measure the frequency of `postMessage` violating `connect-src`

If we'd like to govern `postMessage` targeting via CSP, `connect-src`
seems like the obvious route (perhaps with a `postmessage-src` hanging
off of it, a la `script-src`/`worker-src`?). Let's see whether or not we
have that option by evaluating the existing usage of both.

Discussion in https://github.com/w3c/webappsec-csp/issues/117

R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2873223003
Cr-Commit-Position: refs/heads/master@{#471300}
Committed: https://chromium.googlesource.com/chromium/src/+/81f48952b66a6e79eb286297462381e08eda47ab

[Mike West, 2017-05-10 08:16:15]

The CQ bit was checked by mkwst@chromium.org to run a CQ dry run

[Mike West, 2017-05-10 08:16:24]

WDYT, Jochen?

[commit-bot: I haz the power, 2017-05-10 08:16:43]

Dry run: CQ is trying da patch.

Follow status at:
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[jochen (gone - plz use gerrit), 2017-05-10 08:17:55]

lgtm

[Mike West, 2017-05-10 08:55:28]

The CQ bit was unchecked by mkwst@chromium.org

[Mike West, 2017-05-10 08:55:30]

The CQ bit was checked by mkwst@chromium.org

[commit-bot: I haz the power, 2017-05-10 08:55:54]

CQ is trying da patch.

Follow status at:
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-05-10 12:37:09]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-05-10 12:37:10]

Try jobs failed on following builders:
  linux_chromium_rel_ng on master.tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

[Mike West, 2017-05-10 13:16:38]

The CQ bit was checked by mkwst@chromium.org

[commit-bot: I haz the power, 2017-05-10 13:16:55]

CQ is trying da patch.

Follow status at:
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-05-10 15:38:58]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-05-10 15:38:59]

Try jobs failed on following builders:
  linux_chromium_rel_ng on master.tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

[Mike West, 2017-05-11 10:56:17]

The CQ bit was checked by mkwst@chromium.org

[commit-bot: I haz the power, 2017-05-11 10:56:41]

CQ is trying da patch.

Follow status at:
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-05-11 12:58:11]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-05-11 12:58:12]

Try jobs failed on following builders:
  win_chromium_rel_ng on master.tryserver.chromium.win (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.win/builders/win_chromium_rel_...)

[Mike West, 2017-05-12 08:19:42]

The CQ bit was checked by mkwst@chromium.org

[commit-bot: I haz the power, 2017-05-12 08:20:05]

CQ is trying da patch.

Follow status at:
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-05-12 08:29:49]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-05-12 08:29:49]

Try jobs failed on following builders:
  win_chromium_rel_ng on master.tryserver.chromium.win (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.win/builders/win_chromium_rel_...)

[Mike West, 2017-05-12 10:09:28]

The CQ bit was checked by mkwst@chromium.org

[Mike West, 2017-05-12 10:09:28]

The patchset sent to the CQ was uploaded after l-g-t-m from jochen@chromium.org
Link to the patchset: https://codereview.chromium.org/2873223003/#ps20001
(title: "Rebase.")

[commit-bot: I haz the power, 2017-05-12 10:09:45]

CQ is trying da patch.

Follow status at:
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-05-12 11:24:47]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-05-12 11:24:48]

Try jobs failed on following builders:
  mac_chromium_rel_ng on master.tryserver.chromium.mac (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.mac/builders/mac_chromium_rel_...)

[Mike West, 2017-05-12 13:24:10]

The CQ bit was checked by mkwst@chromium.org

[commit-bot: I haz the power, 2017-05-12 13:24:29]

CQ is trying da patch.

Follow status at:
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-05-12 15:30:11]

CQ is committing da patch.

Bot data: {"patchset_id": 20001, "attempt_start_ts": 1494595450237410,
"parent_rev": "79a9cbda265c5ab725a0a25d725980bd0b376439", "commit_rev":
"81f48952b66a6e79eb286297462381e08eda47ab"}

[commit-bot: I haz the power, 2017-05-12 15:30:25]

Description was changed from

==========
CSP: Measure the frequency of `postMessage` violating `connect-src`

If we'd like to govern `postMessage` targeting via CSP, `connect-src`
seems like the obvious route (perhaps with a `postmessage-src` hanging
off of it, a la `script-src`/`worker-src`?). Let's see whether or not we
have that option by evaluating the existing usage of both.

Discussion in https://github.com/w3c/webappsec-csp/issues/117

R=jochen@chromium.org
==========

to

==========
CSP: Measure the frequency of `postMessage` violating `connect-src`

If we'd like to govern `postMessage` targeting via CSP, `connect-src`
seems like the obvious route (perhaps with a `postmessage-src` hanging
off of it, a la `script-src`/`worker-src`?). Let's see whether or not we
have that option by evaluating the existing usage of both.

Discussion in https://github.com/w3c/webappsec-csp/issues/117

R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2873223003
Cr-Commit-Position: refs/heads/master@{#471300}
Committed:
https://chromium.googlesource.com/chromium/src/+/81f48952b66a6e79eb2862974623...
==========

[commit-bot: I haz the power, 2017-05-12 15:30:26]

Committed patchset #2 (id:20001) as
https://chromium.googlesource.com/chromium/src/+/81f48952b66a6e79eb2862974623...