CORS: Measure some ways in which we might tighten CORS processing.

third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp

Index: third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
diff --git a/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp b/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
index 7031a1942e53ea1ae76dddcee584c27fc5759480..7e9c54c2b8913beeafa6daf56d171c083cd01007 100644
--- a/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
+++ b/third_party/WebKit/Source/core/loader/DocumentThreadableLoader.cpp
@@ -600,6 +600,8 @@ bool DocumentThreadableLoader::RedirectReceived(
           builder, cors_status, redirect_response, GetSecurityOrigin(),
           request_context_);
       access_control_error_description = builder.ToString();
+    } else {
+      MeasureAccessControlAllowOrigin(redirect_response);
     }
   }
 
@@ -733,6 +735,8 @@ void DocumentThreadableLoader::HandlePreflightResponse(
         builder, cors_status, response, GetSecurityOrigin(), request_context_);
     HandlePreflightFailure(response.Url().GetString(), builder.ToString());
     return;
+  } else {
+    MeasureAccessControlAllowOrigin(response);
   }
 
   CrossOriginAccessControl::PreflightStatus preflight_status =
@@ -852,6 +856,8 @@ void DocumentThreadableLoader::HandleResponse(
           ResourceError(kErrorDomainBlinkInternal, 0,
                         response.Url().GetString(), builder.ToString()));
       return;
+    } else {
+      MeasureAccessControlAllowOrigin(response);
     }
   }
 
@@ -1162,6 +1168,30 @@ Document* DocumentThreadableLoader::GetDocument() const {
   return loading_context_->GetLoadingDocument();
 }
 
+void DocumentThreadableLoader::MeasureAccessControlAllowOrigin(
+    const ResourceResponse& response) const {
+  DEFINE_STATIC_LOCAL(AtomicString, null_token, ("null"));
+  const AtomicString& acao =
+      response.HttpHeaderField(HTTPNames::Access_Control_Allow_Origin);
+  if (acao == null_token && EffectiveAllowCredentials()) {
+    loading_context_->RecordUseCount(
+        UseCounter::kAccessControlAllowOriginNullWithCredentials);
+  }
+  if (SecurityOrigin::IsSecure(response.Url()) &&
+      !GetSecurityOrigin()->IsPotentiallyTrustworthy()) {
+    if (acao == g_star_atom) {
+      loading_context_->RecordUseCount(
+          UseCounter::kAccessControlAllowOriginInsecureStarFromHTTPS);
+    } else if (acao == null_token) {
+      loading_context_->RecordUseCount(
+          UseCounter::kAccessControlAllowOriginInsecureNullFromHTTPS);
+    } else {
+      loading_context_->RecordUseCount(
+          UseCounter::kAccessControlAllowOriginInsecureExplicitFromHTTPS);
+    }
+  }
+}
+
 DEFINE_TRACE(DocumentThreadableLoader) {
   visitor->Trace(resource_);
   visitor->Trace(loading_context_);