CSP: Measure the frequency of `postMessage` violating `connect-src`

third_party/WebKit/Source/core/frame/DOMWindow.cpp

Index: third_party/WebKit/Source/core/frame/DOMWindow.cpp
diff --git a/third_party/WebKit/Source/core/frame/DOMWindow.cpp b/third_party/WebKit/Source/core/frame/DOMWindow.cpp
index 0eef0681459756f6281eff8d1743511e109bb5ca..494b9c9621af541389e29938ff45d6541bfcfb77 100644
--- a/third_party/WebKit/Source/core/frame/DOMWindow.cpp
+++ b/third_party/WebKit/Source/core/frame/DOMWindow.cpp
@@ -18,6 +18,7 @@
 #include "core/frame/Location.h"
 #include "core/frame/Settings.h"
 #include "core/frame/UseCounter.h"
+#include "core/frame/csp/ContentSecurityPolicy.h"
 #include "core/input/InputDeviceCapabilities.h"
 #include "core/inspector/ConsoleMessage.h"
 #include "core/loader/MixedContentChecker.h"
@@ -235,6 +236,13 @@ void DOMWindow::postMessage(PassRefPtr<SerializedScriptValue> message,
     }
   }
 
+  if (!source_document->GetContentSecurityPolicy()->AllowConnectToSource(
+          target_url, RedirectStatus::kNoRedirect,
+          SecurityViolationReportingPolicy::kSuppressReporting)) {
+    UseCounter::Count(
+        GetFrame(), UseCounter::kPostMessageOutgoingWouldBeBlockedByConnectSrc);
+  }
+
   MessageEvent* event =
       MessageEvent::Create(std::move(channels), std::move(message),
                            source_origin, String(), source, source_suborigin);