CSP: Measure the frequency of `postMessage` violating `connect-src`

third_party/WebKit/Source/core/frame/LocalDOMWindow.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 47 matching lines @@
 #include "core/frame/FrameView.h"
 #include "core/frame/History.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/LocalFrameClient.h"
 #include "core/frame/Navigator.h"
 #include "core/frame/Screen.h"
 #include "core/frame/ScrollToOptions.h"
 #include "core/frame/Settings.h"
 #include "core/frame/SuspendableTimer.h"
 #include "core/frame/VisualViewport.h"
+#include "core/frame/csp/ContentSecurityPolicy.h"
 #include "core/html/HTMLFrameOwnerElement.h"
 #include "core/input/EventHandler.h"
 #include "core/inspector/ConsoleMessage.h"
 #include "core/inspector/InspectorTraceEvents.h"
 #include "core/loader/DocumentLoader.h"
 #include "core/loader/appcache/ApplicationCache.h"
 #include "core/page/ChromeClient.h"
 #include "core/page/CreateWindow.h"
 #include "core/page/Page.h"
 #include "core/page/WindowFeatures.h"
@@ skipping 618 matching lines @@
               "') does not match the recipient window's origin ('" +
               document()->GetSecurityOrigin()->ToString() + "').");
       ConsoleMessage* console_message =
           ConsoleMessage::Create(kSecurityMessageSource, kErrorMessageLevel,
                                  message, std::move(location));
       GetFrameConsole()->AddMessage(console_message);
       return;
     }
   }
 
+  KURL sender(kParsedURLString, static_cast<MessageEvent*>(event)->origin());
+  if (!document()->GetContentSecurityPolicy()->AllowConnectToSource(
+          sender, RedirectStatus::kNoRedirect,
+          SecurityViolationReportingPolicy::kSuppressReporting)) {
+    UseCounter::Count(
+        GetFrame(), UseCounter::kPostMessageIncomingWouldBeBlockedByConnectSrc);
+  }
+
   DispatchEvent(event);
 }
 
 DOMSelection* LocalDOMWindow::getSelection() {
   if (!IsCurrentlyDisplayedInFrame())
     return nullptr;
 
   return document()->GetSelection();
 }
 
@@ skipping 979 matching lines @@
   DOMWindow::Trace(visitor);
   Supplementable<LocalDOMWindow>::Trace(visitor);
 }
 
 DEFINE_TRACE_WRAPPERS(LocalDOMWindow) {
   visitor->TraceWrappers(custom_elements_);
   DOMWindow::TraceWrappers(visitor);
 }
 
 }  // namespace blink