CSP: Add 'script-sample' to violation reports.

third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp

 /*
  * Copyright (C) 2011 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 395 matching lines @@
   bool isAllowed = true;
   for (const auto& policy : policies) {
     isAllowed &=
         (policy.get()->*allowed)(scriptState, reportingPolicy, exceptionStatus);
   }
   return isAllowed;
 }
 
 template <bool (CSPDirectiveList::*allowed)(Element*,
                                             const String&,
+                                            const String&,
                                             const WTF::OrdinalNumber&,
                                             SecurityViolationReportingPolicy)
               const>
 bool isAllowedByAll(const CSPDirectiveListVector& policies,
                     Element* element,
+                    const String& source,
                     const String& contextURL,
                     const WTF::OrdinalNumber& contextLine,
                     SecurityViolationReportingPolicy reportingPolicy) {
   bool isAllowed = true;
   for (const auto& policy : policies) {
-    isAllowed &= (policy.get()->*allowed)(element, contextURL, contextLine,
-                                          reportingPolicy);
+    isAllowed &= (policy.get()->*allowed)(element, source, contextURL,
+                                          contextLine, reportingPolicy);
   }
   return isAllowed;
 }
 
 template <bool (CSPDirectiveList::*allowed)(Element*,
                                             const String&,
                                             const String&,
                                             const WTF::OrdinalNumber&,
                                             SecurityViolationReportingPolicy,
                                             const String& content) const>
@@ skipping 172 matching lines @@
               type))
         return true;
     }
   }
 
   return false;
 }
 
 bool ContentSecurityPolicy::allowJavaScriptURLs(
     Element* element,
+    const String& source,
     const String& contextURL,
     const WTF::OrdinalNumber& contextLine,
     SecurityViolationReportingPolicy reportingPolicy) const {
   return isAllowedByAll<&CSPDirectiveList::allowJavaScriptURLs>(
-      m_policies, element, contextURL, contextLine, reportingPolicy);
+      m_policies, element, source, contextURL, contextLine, reportingPolicy);
 }
 
 bool ContentSecurityPolicy::allowInlineEventHandler(
     Element* element,
     const String& source,
     const String& contextURL,
     const WTF::OrdinalNumber& contextLine,
     SecurityViolationReportingPolicy reportingPolicy) const {
   // Inline event handlers may be whitelisted by hash, if
   // 'unsafe-hash-attributes' is present in a policy. Check against the digest
   // of the |source| first before proceeding on to checking whether inline
   // script is allowed.
   if (checkDigest<&CSPDirectiveList::allowScriptHash>(
           source, InlineType::Attribute, m_scriptHashAlgorithmsUsed,
           m_policies))
     return true;
   return isAllowedByAll<&CSPDirectiveList::allowInlineEventHandlers>(
-      m_policies, element, contextURL, contextLine, reportingPolicy);
+      m_policies, element, source, contextURL, contextLine, reportingPolicy);
 }
 
 bool ContentSecurityPolicy::allowInlineScript(
     Element* element,
     const String& contextURL,
     const String& nonce,
     const WTF::OrdinalNumber& contextLine,
     const String& scriptContent,
     SecurityViolationReportingPolicy reportingPolicy) const {
   DCHECK(element);
@@ skipping 380 matching lines @@
 static void gatherSecurityPolicyViolationEventData(
     SecurityPolicyViolationEventInit& init,
     ExecutionContext* context,
     const String& directiveText,
     const ContentSecurityPolicy::DirectiveType& effectiveType,
     const KURL& blockedURL,
     const String& header,
     RedirectStatus redirectStatus,
     ContentSecurityPolicyHeaderType headerType,
     ContentSecurityPolicy::ViolationType violationType,
-    int contextLine) {
+    int contextLine,
+    const String& scriptSource) {
   if (effectiveType == ContentSecurityPolicy::DirectiveType::FrameAncestors) {
     // If this load was blocked via 'frame-ancestors', then the URL of
     // |document| has not yet been initialized. In this case, we'll set both
     // 'documentURI' and 'blockedURI' to the blocked document's URL.
     init.setDocumentURI(blockedURL.getString());
     init.setBlockedURI(blockedURL.getString());
   } else {
     init.setDocumentURI(context->url().getString());
     switch (violationType) {
       case ContentSecurityPolicy::InlineViolation:
@@ skipping 33 matching lines @@
   }
 
   std::unique_ptr<SourceLocation> location = SourceLocation::capture(context);
   if (location->lineNumber()) {
     KURL source = KURL(ParsedURLString, location->url());
     init.setSourceFile(
         stripURLForUseInReport(context, source, redirectStatus, effectiveType));
     init.setLineNumber(location->lineNumber());
     init.setColumnNumber(location->columnNumber());
   }
+
+  if (!scriptSource.isEmpty())
+    init.setSample(scriptSource.stripWhiteSpace().left(40));
 }
 
 void ContentSecurityPolicy::reportViolation(
     const String& directiveText,
     const DirectiveType& effectiveType,
     const String& consoleMessage,
     const KURL& blockedURL,
     const Vector<String>& reportEndpoints,
     const String& header,
     ContentSecurityPolicyHeaderType headerType,
     ViolationType violationType,
     LocalFrame* contextFrame,
     RedirectStatus redirectStatus,
     int contextLine,
-    Element* element) {
+    Element* element,
+    const String& source) {
   ASSERT(violationType == URLViolation || blockedURL.isEmpty());
 
   // TODO(lukasza): Support sending reports from OOPIFs -
   // https://crbug.com/611232 (or move CSP child-src and frame-src checks to the
   // browser process - see https://crbug.com/376522).
   if (!m_executionContext && !contextFrame) {
     DCHECK(effectiveType == DirectiveType::ChildSrc ||
            effectiveType == DirectiveType::FrameSrc ||
            effectiveType == DirectiveType::PluginTypes);
     return;
   }
 
   DCHECK((m_executionContext && !contextFrame) ||
          ((effectiveType == DirectiveType::FrameAncestors) && contextFrame));
 
   SecurityPolicyViolationEventInit violationData;
 
   // If we're processing 'frame-ancestors', use |contextFrame|'s execution
   // context to gather data. Otherwise, use the policy's execution context.
   ExecutionContext* relevantContext =
       contextFrame ? contextFrame->document() : m_executionContext;
   DCHECK(relevantContext);
   gatherSecurityPolicyViolationEventData(
       violationData, relevantContext, directiveText, effectiveType, blockedURL,
-      header, redirectStatus, headerType, violationType, contextLine);
+      header, redirectStatus, headerType, violationType, contextLine, source);
 
   // TODO(mkwst): Obviously, we shouldn't hit this check, as extension-loaded
   // resources should be allowed regardless. We apparently do, however, so
   // we should at least stop spamming reporting endpoints. See
   // https://crbug.com/524356 for detail.
   if (!violationData.sourceFile().isEmpty() &&
       SchemeRegistry::schemeShouldBypassContentSecurityPolicy(
           KURL(ParsedURLString, violationData.sourceFile()).protocol())) {
     return;
   }
@@ skipping 41 matching lines @@
   cspReport->setString("disposition", violationData.disposition());
   cspReport->setString("blocked-uri", violationData.blockedURI());
   if (violationData.lineNumber())
     cspReport->setInteger("line-number", violationData.lineNumber());
   if (violationData.columnNumber())
     cspReport->setInteger("column-number", violationData.columnNumber());
   if (!violationData.sourceFile().isEmpty())
     cspReport->setString("source-file", violationData.sourceFile());
   cspReport->setInteger("status-code", violationData.statusCode());
 
+  if (experimentalFeaturesEnabled())
+    cspReport->setString("sample", violationData.sample());
+
   std::unique_ptr<JSONObject> reportObject = JSONObject::create();
   reportObject->setObject("csp-report", std::move(cspReport));
   String stringifiedReport = reportObject->toJSONString();
 
   // Only POST unique reports to the external endpoint; repeated reports add no
   // value on the server side, as they're indistinguishable. Note that we'll
   // fire the DOM event for every violation, as the page has enough context to
   // react in some reasonable way to each violation as it occurs.
   if (shouldSendViolationReport(stringifiedReport)) {
     didSendViolationReport(stringifiedReport);
@@ skipping 417 matching lines @@
   CSPDirectiveListVector otherVector;
   for (const auto& policy : other.m_policies) {
     if (!policy->isReportOnly())
       otherVector.push_back(policy);
   }
 
   return m_policies[0]->subsumes(otherVector);
 }
 
 }  // namespace blink