Restrict the xss audit report URL to same origin

BUG=441275
R=tsepez@chromium.org,mkwst@chromium.org

Change-Id: I27bc8e251b9ad962c3b4fdebf084a2b9152f915d
Reviewed-on: https://chromium-review.googlesource.com/768367
Reviewed-by: Tom Sepez <tsepez@chromium.org>
Reviewed-by: Mike West <mkwst@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#516666}
bool XSSAuditor::FilterFrameToken(const FilterTokenRequest& request) {
  DCHECK_EQ(request.token.GetType(), HTMLToken::kStartTag);
  DCHECK(HasName(request.token, iframeTag) || HasName(request.token, frameTag));

  bool did_block_script = EraseAttributeIfInjected(
      request, srcdocAttr, String(), kScriptLikeAttributeTruncation);
  if (IsContainedInRequest(CanonicalizedSnippetForTagName(request)))
    did_block_script |= EraseAttributeIfInjected(request, srcAttr, String(),
                                                 kSrcLikeAttributeTruncation);

  return did_block_script;
}

bool XSSAuditor::FilterFrameToken(const FilterTokenRequest& request) {
  DCHECK_EQ(request.token.GetType(), HTMLToken::kStartTag);
  DCHECK(HasName(request.token, iframeTag) || HasName(request.token, frameTag));

  bool did_block_script = EraseAttributeIfInjected(
      request, srcdocAttr, String(), kScriptLikeAttributeTruncation);
  if (IsContainedInRequest(CanonicalizedSnippetForTagName(request)))
    did_block_script |= EraseAttributeIfInjected(request, srcAttr, String(),
                                                 kSrcLikeAttributeTruncation);

  return did_block_script;
}
