CSP: Add 'script-sample' to violation reports.

third_party/WebKit/Source/web/WebPluginContainerImpl.cpp

Index: third_party/WebKit/Source/web/WebPluginContainerImpl.cpp
diff --git a/third_party/WebKit/Source/web/WebPluginContainerImpl.cpp b/third_party/WebKit/Source/web/WebPluginContainerImpl.cpp
index cc943a8fd88d95152bec7a04673322a6b0fb05b3..dfce5182a8173185557ecc8d4d5e719928dacb2c 100644
--- a/third_party/WebKit/Source/web/WebPluginContainerImpl.cpp
+++ b/third_party/WebKit/Source/web/WebPluginContainerImpl.cpp
@@ -468,17 +468,17 @@ WebString WebPluginContainerImpl::executeScriptURL(const WebURL& url,
   if (!frame)
     return WebString();
 
-  if (!m_element->document().contentSecurityPolicy()->allowJavaScriptURLs(
-          m_element, m_element->document().url(), OrdinalNumber())) {
-    return WebString();
-  }
-
   const KURL& kurl = url;
   DCHECK(kurl.protocolIs("javascript"));
 
   String script = decodeURLEscapeSequences(
       kurl.getString().substring(strlen("javascript:")));
 
+  if (!m_element->document().contentSecurityPolicy()->allowJavaScriptURLs(
+          m_element, script, m_element->document().url(), OrdinalNumber())) {
+    return WebString();
+  }
+
   UserGestureIndicator gestureIndicator(
       popupsAllowed ? DocumentUserGestureToken::create(
                           frame->document(), UserGestureToken::NewGesture)