Initial Fetch integration for Subresource Integrity

Source/core/frame/SubresourceIntegrity.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/frame/SubresourceIntegrity.h"
 
 #include "core/HTMLNames.h"
 #include "core/dom/Document.h"
 #include "core/dom/Element.h"
@@ skipping 96 matching lines @@
     String attribute = element.fastGetAttribute(HTMLNames::integrityAttr);
     if (attribute.isEmpty())
         return true;
 
     if (!resource.isEligibleForIntegrityCheck(document.securityOrigin())) {
         UseCounter::count(document, UseCounter::SRIElementIntegrityAttributeButIneligible);
         logErrorToConsole("Subresource Integrity: The resource '" + resourceUrl.elidedString() + "' has an integrity attribute, but the resource requires the request to be CORS enabled to check the integrity, and it is not. The resource has not been blocked, but no integrity check occurred.", document);
         return false;
     }
 
+    String errorMessage;
+    bool result = CheckSubresourceIntegrity(attribute, source, resourceUrl, document, errorMessage);
+    logErrorToConsole(errorMessage, document);

[sof, 2015/08/20 20:29:29]

Don't you need to consider 'result' before logging?

[jww, 2015/08/20 23:16:44]

Yes, fantastic catch. Thanks, and fixed.

+    return result;
+}
+
+bool SubresourceIntegrity::CheckSubresourceIntegrity(const String& integrityMetadata, const WTF::String& source, const KURL& resourceUrl, Document& document, String& errorMessage)
+{
     WTF::Vector<IntegrityMetadata> metadataList;
-    IntegrityParseResult integrityParseResult = parseIntegrityAttribute(attribute, metadataList, document);
+    IntegrityParseResult integrityParseResult = parseIntegrityAttribute(integrityMetadata, metadataList, document);
     // On failed parsing, there's no need to log an error here, as
     // parseIntegrityAttribute() will output an appropriate console message.
     if (integrityParseResult != IntegrityParseValidResult)
         return true;
 
     StringUTF8Adaptor normalizedSource(source, StringUTF8Adaptor::Normalize, WTF::EntitiesForUnencodables);
 
     if (!metadataList.size())
         return true;
 
@@ skipping 22 matching lines @@
         }
     }
 
     digest.clear();
     if (computeDigest(HashAlgorithmSha256, normalizedSource.data(), normalizedSource.length(), digest)) {
         // This message exposes the digest of the resource to the console.
         // Because this is only to the console, that's okay for now, but we
         // need to be very careful not to expose this in exceptions or
         // JavaScript, otherwise it risks exposing information about the
         // resource cross-origin.
-        logErrorToConsole("Failed to find a valid digest in the 'integrity' attribute for resource '" + resourceUrl.elidedString() + "' with computed SHA-256 integrity '" + digestToString(digest) + "'. The resource has been blocked.", document);
+        errorMessage = "Failed to find a valid digest in the 'integrity' attribute for resource '" + resourceUrl.elidedString() + "' with computed SHA-256 integrity '" + digestToString(digest) + "'. The resource has been blocked.";
     } else {
-        logErrorToConsole("There was an error computing an integrity value for resource '" + resourceUrl.elidedString() + "'. The resource has been blocked.", document);
+        errorMessage = "There was an error computing an integrity value for resource '" + resourceUrl.elidedString() + "'. The resource has been blocked.";
     }
     UseCounter::count(document, UseCounter::SRIElementWithNonMatchingIntegrityAttribute);
     return false;
 }
 
 // Before:
 //
 // [algorithm]-[hash]
 // ^                 ^
 // position          end
@@ skipping 143 matching lines @@
         metadataList.append(integrityMetadata);
     }
 
     if (metadataList.size() == 0 && error)
         return IntegrityParseNoValidResult;
 
     return IntegrityParseValidResult;
 }
 
 } // namespace blink