From e21d466d13dca371148fddbbd81eae837fca1c83 Mon Sep 17 00:00:00 2001
From: Brian Smith <brian@dbsoft.org>
Date: Mon, 8 Jan 2024 08:49:05 -0600
Subject: [PATCH] Issue #2402 - Print Related JS-Line on CSP Violation (if
 any). https://bugzilla.mozilla.org/show_bug.cgi?id=1100630

---
 dom/security/nsCSPContext.cpp | 47 +++++++++++++++++++++++++++--------
 1 file changed, 37 insertions(+), 10 deletions(-)

diff --git a/dom/security/nsCSPContext.cpp b/dom/security/nsCSPContext.cpp
index a52e741e8d..9a71f9b2eb 100644
--- a/dom/security/nsCSPContext.cpp
+++ b/dom/security/nsCSPContext.cpp
@@ -264,16 +264,25 @@ nsCSPContext::permitsInternal(CSPDirective aDir,
       // decision may be wrong due to the inability to get the nonce, and will
       // incorrectly fail the unit tests.
       if (!aIsPreload && aSendViolationReports) {
+        uint32_t lineNumber = 0;
+        uint32_t columnNumber = 0;
+        nsAutoCString spec;
+        JSContext* cx = nsContentUtils::GetCurrentJSContext();
+        if (cx) {
+          nsJSUtils::GetCallingLocation(cx, spec, &lineNumber, &columnNumber);
+          // If GetCallingLocation fails linenumber & columnNumber are set to 0
+          // anyway so we can skip checking if that is the case.
+        }
         this->AsyncReportViolation((aSendContentLocationInViolationReports ?
                                     aContentLocation : nullptr),
-                                   aOriginalURI,  /* in case of redirect originalURI is not null */
-                                   violatedDirective,
-                                   p,             /* policy index        */
-                                   EmptyString(), /* no observer subject */
-                                   EmptyString(), /* no source file      */
-                                   EmptyString(), /* no script sample    */
-                                   0,             /* no line number      */
-                                   0);            /* no column number    */
+                                    aOriginalURI,  /* in case of redirect originalURI is not null */
+                                    violatedDirective,
+                                    p,                           /* policy index        */
+                                    EmptyString(),               /* no observer subject */
+                                    NS_ConvertUTF8toUTF16(spec), /* source file.        */
+                                    EmptyString(),               /* no script sample    */
+                                    lineNumber,                  /* line number         */
+                                    columnNumber);               /* column number       */
       }
     }
   }
@@ -294,6 +303,8 @@ NS_IMPL_ISUPPORTS_CI(nsCSPContext,
                      nsIContentSecurityPolicy,
                      nsISerializable)
 
+int32_t nsCSPContext::sScriptSampleMaxLength;
+
 nsCSPContext::nsCSPContext()
   : mInnerWindowID(0)
   , mLoadingContext(nullptr)
@@ -516,6 +527,22 @@ nsCSPContext::reportInlineViolation(nsContentPolicyType aContentType,
     codeSample.Truncate(ScriptSampleMaxLength());
     codeSample.AppendLiteral("...");
   }
+
+  uint32_t lineNumber = aLineNumber;
+  uint32_t columnNumber = aColumnNumber;
+
+  JSContext* cx = nsContentUtils::GetCurrentJSContext();
+  if (cx) {
+    if (!nsJSUtils::GetCallingLocation(cx, sourceFile, &lineNumber,
+                                       &columnNumber)) {
+      // Get Calling Location resets line/col to 0
+      // so we reset those to the intial arguments
+      // in case it failed
+      lineNumber = aLineNumber;
+      columnNumber = aColumnNumber;
+    }
+  }
+
   AsyncReportViolation(selfISupports,                      // aBlockedContentSource
                        mSelfURI,                           // aOriginalURI
                        aViolatedDirective,                 // aViolatedDirective
@@ -523,8 +550,8 @@ nsCSPContext::reportInlineViolation(nsContentPolicyType aContentType,
                        observerSubject,                    // aObserverSubject
                        NS_ConvertUTF8toUTF16(sourceFile),  // aSourceFile
                        codeSample,                         // aScriptSample
-                       aLineNumber,                        // aLineNum
-                       aColumnNumber);                     // aColumnNum
+                       lineNumber,                         // aLineNum
+                       columnNumber);                      // aColumnNum
 }
 
 NS_IMETHODIMP