Apply CSP default-src hash values to script-src and style src.

Source/core/frame/csp/CSPDirectiveList.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/frame/csp/CSPDirectiveList.h"
 
 #include "core/dom/Document.h"
 #include "core/dom/SecurityContext.h"
 #include "core/dom/SpaceSplitString.h"
@@ skipping 730 matching lines @@
 
     return String(begin, length);
 }
 
 void CSPDirectiveList::addDirective(const String& name, const String& value)
 {
     ASSERT(!name.isEmpty());
 
     if (equalIgnoringCase(name, ContentSecurityPolicy::DefaultSrc)) {
         setCSPDirective<SourceListDirective>(name, value, m_defaultSrc);
+        // TODO(mkwst) It seems unlikely that developers would use different
+        // algorithms for scripts and styles. We may want to combine the
+        // usesScriptHashAlgorithms() and usesStyleHashAlgorithms.
+        m_policy->usesScriptHashAlgorithms(m_defaultSrc->hashAlgorithmsUsed());
+        m_policy->usesStyleHashAlgorithms(m_defaultSrc->hashAlgorithmsUsed());
     } else if (equalIgnoringCase(name, ContentSecurityPolicy::ScriptSrc)) {
         setCSPDirective<SourceListDirective>(name, value, m_scriptSrc);
         m_policy->usesScriptHashAlgorithms(m_scriptSrc->hashAlgorithmsUsed());
     } else if (equalIgnoringCase(name, ContentSecurityPolicy::ObjectSrc)) {
         setCSPDirective<SourceListDirective>(name, value, m_objectSrc);
     } else if (equalIgnoringCase(name, ContentSecurityPolicy::FrameAncestors)) {
         setCSPDirective<SourceListDirective>(name, value, m_frameAncestors);
     } else if (equalIgnoringCase(name, ContentSecurityPolicy::FrameSrc)) {
         setCSPDirective<SourceListDirective>(name, value, m_frameSrc);
     } else if (equalIgnoringCase(name, ContentSecurityPolicy::ImgSrc)) {
@@ skipping 31 matching lines @@
         setCSPDirective<SourceListDirective>(name, value, m_manifestSrc);
     } else if (RuntimeEnabledFeatures::suboriginsEnabled() && equalIgnoringCase(name, ContentSecurityPolicy::Suborigin)) {
         applySuboriginPolicy(name, value);
     } else {
         m_policy->reportUnsupportedDirective(name);
     }
 }
 
 
 } // namespace blink