Add CSP header for resources with an active policy

Source/core/frame/csp/ContentSecurityPolicy.cpp

 /*
  * Copyright (C) 2011 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 403 matching lines @@
         if (algorithmMap.cspHashAlgorithm & hashAlgorithmsUsed) {
             bool digestSuccess = computeDigest(algorithmMap.algorithm, normalizedSource.data(), normalizedSource.length(), digest);
             if (digestSuccess && isAllowedByAllWithHash<allowed>(policies, CSPHashValue(algorithmMap.cspHashAlgorithm, digest)))
                 return true;
         }
     }
 
     return false;
 }
 
+template <bool (CSPDirectiveList::*hasPolicy)() const>
+bool hasAnyPolicy(const CSPDirectiveListVector& policies)
+{
+    for (const auto& policy : policies) {
+        if ((policy.get()->*hasPolicy)())
+            return true;
+    }
+    return false;
+}
+
 bool ContentSecurityPolicy::allowJavaScriptURLs(const String& contextURL, const WTF::OrdinalNumber& contextLine, ContentSecurityPolicy::ReportingStatus reportingStatus) const
 {
     return isAllowedByAllWithContext<&CSPDirectiveList::allowJavaScriptURLs>(m_policies, contextURL, contextLine, reportingStatus);
 }
 
 bool ContentSecurityPolicy::allowInlineEventHandlers(const String& contextURL, const WTF::OrdinalNumber& contextLine, ContentSecurityPolicy::ReportingStatus reportingStatus) const
 {
     return isAllowedByAllWithContext<&CSPDirectiveList::allowInlineEventHandlers>(m_policies, contextURL, contextLine, reportingStatus);
 }
 
@@ skipping 459 matching lines @@
 void ContentSecurityPolicy::reportBlockedScriptExecutionToInspector(const String& directiveText) const
 {
     m_executionContext->reportBlockedScriptExecutionToInspector(directiveText);
 }
 
 bool ContentSecurityPolicy::experimentalFeaturesEnabled() const
 {
     return RuntimeEnabledFeatures::experimentalContentSecurityPolicyFeaturesEnabled();
 }
 
+bool ContentSecurityPolicy::hasScriptPolicy() const
+{
+    return hasAnyPolicy<&CSPDirectiveList::hasScriptPolicy>(m_policies);
+}
+
+bool ContentSecurityPolicy::hasStylePolicy() const
+{
+    return hasAnyPolicy<&CSPDirectiveList::hasStylePolicy>(m_policies);
+}
+
+bool ContentSecurityPolicy::hasImagePolicy() const
+{
+    return hasAnyPolicy<&CSPDirectiveList::hasImagePolicy>(m_policies);
+}
+
+bool ContentSecurityPolicy::hasFontPolicy() const
+{
+    return hasAnyPolicy<&CSPDirectiveList::hasFontPolicy>(m_policies);
+}
+
+bool ContentSecurityPolicy::hasMediaPolicy() const
+{
+    return hasAnyPolicy<&CSPDirectiveList::hasMediaPolicy>(m_policies);
+}
+
+bool ContentSecurityPolicy::hasPluginPolicy() const
+{
+    return hasAnyPolicy<&CSPDirectiveList::hasPluginPolicy>(m_policies);
+}
+
 bool ContentSecurityPolicy::urlMatchesSelf(const KURL& url) const
 {
     return m_selfSource->matches(url, DidNotRedirect);
 }
 
 bool ContentSecurityPolicy::protocolMatchesSelf(const KURL& url) const
 {
     if (equalIgnoringCase("http", m_selfProtocol))
         return url.protocolIsInHTTPFamily();
     return equalIgnoringCase(url.protocol(), m_selfProtocol);
@@ skipping 14 matching lines @@
     // Collisions have no security impact, so we can save space by storing only the string's hash rather than the whole report.
     return !m_violationReportsSent.contains(report.impl()->hash());
 }
 
 void ContentSecurityPolicy::didSendViolationReport(const String& report)
 {
     m_violationReportsSent.add(report.impl()->hash());
 }
 
 } // namespace blink