Initial Fetch integration for Subresource Integrity

Source/core/dom/ScriptLoader.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nikolas Zimmermann <zimmermann@kde.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 360 matching lines @@
         if (sourceCode.resource()->response().wasFetchedViaServiceWorker()) {
             if (sourceCode.resource()->response().serviceWorkerResponseType() == WebServiceWorkerResponseTypeOpaque)
                 accessControlStatus = OpaqueResource;
             else
                 accessControlStatus = SharableCrossOrigin;
         } else if (sourceCode.resource()->passesAccessControlCheck(m_element->document().securityOrigin())) {
             accessControlStatus = SharableCrossOrigin;
         }
     }
 
+    // The following SRI checks need to be here because, unfortunately, fetches
+    // are not done purely according to the Fetch spec. In particular,
+    // different requests for the same resource do not have different
+    // responses; the memory cache can (and will) return the exact same
+    // Resource object.  For different requests, the same Resource object will
+    // be returned and will not be associated with the particular request.
+    // Therefore, when the body of the response comes in, there's no way to
+    // validate the integrity of the Resource object against a particular
+    // request (since there may be several pending requests all tied to the
+    // identical object, and the actual requests are not stored).
+    //
+    // In order to simulate the correct behavior, Blink explicitly does the SRI
+    // checks at execution here (similar to the AccessControlStatus check done
+    // above), while having proper Fetch checks in the fetch module for use in
+    // the fetch JavaScript API. In a future world where the ResourceFetcher
+    // uses the Fetch algorithm, this should be fixed by having separate
+    // Response objects (perhaps attached to identical Resource objects) per
+    // request.  See https://crbug.com/500701 for more information.
     if (m_isExternalScript) {
         const KURL resourceUrl = sourceCode.resource()->resourceRequest().url();
         if (!SubresourceIntegrity::CheckSubresourceIntegrity(*m_element, sourceCode.source(), sourceCode.resource()->url(), *sourceCode.resource())) {
             return false;
         }
     }
 
     const bool isImportedScript = contextDocument != elementDocument;
     // http://www.whatwg.org/specs/web-apps/current-work/#execute-the-script-block step 2.3
     // with additional support for HTML imports.
@@ skipping 107 matching lines @@
     if (isHTMLScriptLoader(element))
         return toHTMLScriptElement(element)->loader();
 
     if (isSVGScriptLoader(element))
         return toSVGScriptElement(element)->loader();
 
     return 0;
 }
 
 } // namespace blink