CORS: Measure some ways in which we might tighten CORS processing.

third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp

 /*
  * Copyright (C) 2011, 2012 Google Inc. All rights reserved.
  * Copyright (C) 2013, Intel Corporation
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 582 matching lines @@
       StringBuilder builder;
       builder.Append("Redirect from '");
       builder.Append(redirect_response.Url().GetString());
       builder.Append("' to '");
       builder.Append(request.Url().GetString());
       builder.Append("' has been blocked by CORS policy: ");
       CrossOriginAccessControl::AccessControlErrorString(
           builder, cors_status, redirect_response, GetSecurityOrigin(),
           request_context_);
       access_control_error_description = builder.ToString();
+    } else {
+      MeasureAccessControlAllowOrigin(redirect_response);
     }
   }
 
   if (!allow_redirect) {
     DispatchDidFailAccessControlCheck(ResourceError(
         kErrorDomainBlinkInternal, 0, redirect_response.Url().GetString(),
         access_control_error_description));
     return false;
   }
 
@@ skipping 113 matching lines @@
           response, EffectiveAllowCredentials(), GetSecurityOrigin());
   if (cors_status != CrossOriginAccessControl::kAccessAllowed) {
     StringBuilder builder;
     builder.Append(
         "Response to preflight request doesn't pass access "
         "control check: ");
     CrossOriginAccessControl::AccessControlErrorString(
         builder, cors_status, response, GetSecurityOrigin(), request_context_);
     HandlePreflightFailure(response.Url().GetString(), builder.ToString());
     return;
+  } else {
+    MeasureAccessControlAllowOrigin(response);
   }
 
   CrossOriginAccessControl::PreflightStatus preflight_status =
       CrossOriginAccessControl::CheckPreflight(response);
   if (preflight_status != CrossOriginAccessControl::kPreflightSuccess) {
     StringBuilder builder;
     CrossOriginAccessControl::PreflightErrorString(builder, preflight_status,
                                                    response);
     HandlePreflightFailure(response.Url().GetString(), builder.ToString());
     return;
@@ skipping 99 matching lines @@
     if (cors_status != CrossOriginAccessControl::kAccessAllowed) {
       ReportResponseReceived(identifier, response);
       StringBuilder builder;
       CrossOriginAccessControl::AccessControlErrorString(
           builder, cors_status, response, GetSecurityOrigin(),
           request_context_);
       DispatchDidFailAccessControlCheck(
           ResourceError(kErrorDomainBlinkInternal, 0,
                         response.Url().GetString(), builder.ToString()));
       return;
+    } else {
+      MeasureAccessControlAllowOrigin(response);
     }
   }
 
   client_->DidReceiveResponse(identifier, response, std::move(handle));
 }
 
 void DocumentThreadableLoader::SetSerializedCachedMetadata(Resource*,
                                                            const char* data,
                                                            size_t size) {
   checker_.SetSerializedCachedMetadata();
@@ skipping 290 matching lines @@
 const SecurityOrigin* DocumentThreadableLoader::GetSecurityOrigin() const {
   return security_origin_ ? security_origin_.Get()
                           : loading_context_->GetSecurityOrigin();
 }
 
 Document* DocumentThreadableLoader::GetDocument() const {
   DCHECK(loading_context_);
   return loading_context_->GetLoadingDocument();
 }
 
+void DocumentThreadableLoader::MeasureAccessControlAllowOrigin(
+    const ResourceResponse& response) const {
+  DEFINE_STATIC_LOCAL(AtomicString, null_token, ("null"));
+  const AtomicString& acao =
+      response.HttpHeaderField(HTTPNames::Access_Control_Allow_Origin);
+  if (acao == null_token && EffectiveAllowCredentials()) {
+    loading_context_->RecordUseCount(
+        UseCounter::kAccessControlAllowOriginNullWithCredentials);
+  }
+  if (SecurityOrigin::IsSecure(response.Url()) &&
+      !GetSecurityOrigin()->IsPotentiallyTrustworthy()) {
+    if (acao == g_star_atom) {
+      loading_context_->RecordUseCount(
+          UseCounter::kAccessControlAllowOriginInsecureStarFromHTTPS);
+    } else if (acao == null_token) {
+      loading_context_->RecordUseCount(
+          UseCounter::kAccessControlAllowOriginInsecureNullFromHTTPS);
+    } else {
+      loading_context_->RecordUseCount(
+          UseCounter::kAccessControlAllowOriginInsecureExplicitFromHTTPS);
+    }
+  }
+}
+
 DEFINE_TRACE(DocumentThreadableLoader) {
   visitor->Trace(resource_);
   visitor->Trace(loading_context_);
   ThreadableLoader::Trace(visitor);
   RawResourceClient::Trace(visitor);
 }
 
 }  // namespace blink