CSP: Add 'script-sample' to violation reports.

third_party/WebKit/Source/bindings/core/v8/ScriptController.cpp

 /*
  * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
  * Copyright (C) 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2014 Opera Software ASA. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
@@ skipping 234 matching lines @@
 
 void ScriptController::updateDocument() {
   m_windowProxyManager->mainWorldProxy()->updateDocument();
 }
 
 bool ScriptController::executeScriptIfJavaScriptURL(const KURL& url,
                                                     Element* element) {
   if (!url.protocolIsJavaScript())
     return false;
 
+  const int javascriptSchemeLength = sizeof("javascript:") - 1;
+  String scriptSource = decodeURLEscapeSequences(url.getString())
+                            .substring(javascriptSchemeLength);
+
   bool shouldBypassMainWorldContentSecurityPolicy =
       ContentSecurityPolicy::shouldBypassMainWorld(frame()->document());
   if (!frame()->page() ||
       (!shouldBypassMainWorldContentSecurityPolicy &&
        !frame()->document()->contentSecurityPolicy()->allowJavaScriptURLs(
-           element, frame()->document()->url(),
+           element, scriptSource, frame()->document()->url(),
            eventHandlerPosition().m_line))) {
     return true;
   }
 
   bool progressNotificationsNeeded =
       frame()->loader().stateMachine()->isDisplayingInitialEmptyDocument() &&
       !frame()->isLoading();
   if (progressNotificationsNeeded)
     frame()->loader().progress().progressStarted(FrameLoadTypeStandard);
 
   Document* ownerDocument = frame()->document();
 
-  const int javascriptSchemeLength = sizeof("javascript:") - 1;
-
   bool locationChangeBefore =
       frame()->navigationScheduler().locationChangePending();
 
-  String decodedURL = decodeURLEscapeSequences(url.getString());
   v8::HandleScope handleScope(isolate());
   v8::Local<v8::Value> result = evaluateScriptInMainWorld(
-      ScriptSourceCode(decodedURL.substring(javascriptSchemeLength)),
-      NotSharableCrossOrigin, DoNotExecuteScriptWhenScriptsDisabled);
+      ScriptSourceCode(scriptSource), NotSharableCrossOrigin,
+      DoNotExecuteScriptWhenScriptsDisabled);
 
   // If executing script caused this frame to be removed from the page, we
   // don't want to try to replace its document!
   if (!frame()->page())
     return true;
 
   if (result.IsEmpty() || !result->IsString()) {
     if (progressNotificationsNeeded)
       frame()->loader().progress().progressCompleted();
     return true;
@@ skipping 88 matching lines @@
     for (size_t i = 0; i < resultArray->Length(); ++i) {
       v8::Local<v8::Value> value;
       if (!resultArray->Get(scriptState->context(), i).ToLocal(&value))
         return;
       results->push_back(value);
     }
   }
 }
 
 }  // namespace blink