CSP: Don't perform NFC normalization prior to hashing

third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/frame/csp/CSPDirectiveList.h"
 
 #include "core/dom/Document.h"
 #include "core/dom/SecurityContext.h"
 #include "core/dom/SpaceSplitString.h"
 #include "core/frame/LocalFrame.h"
 #include "core/inspector/ConsoleMessage.h"
 #include "platform/Crypto.h"
 #include "platform/ParsingUtilities.h"
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/network/ContentSecurityPolicyParsers.h"
 #include "platform/weborigin/KURL.h"
 #include "wtf/text/Base64.h"
 #include "wtf/text/StringUTF8Adaptor.h"
 #include "wtf/text/WTFString.h"
 
 namespace blink {
 
 namespace {
 
 String getSha256String(const String& content)
 {
     DigestValue digest;
-    StringUTF8Adaptor normalizedContent = normalizeSource(content);
-    bool digestSuccess = computeDigest(HashAlgorithmSha256, normalizedContent.data(), normalizedContent.length(), digest);
+    StringUTF8Adaptor utf8Content(content);

[jww, 2015/10/29 21:22:14]

Since we're supposed to use the "script block's source" (for script elements;
it's similar for stylesheets, too), I don't think that technically we should be
using utf8 here necessarily
(http://www.w3.org/TR/html5/scripting-1.html#the-script-block's-source). But
that's not your problem, so I'll try address that in a future CL.

[jsbell, 2015/10/29 22:01:46]

Acknowledged.

+    bool digestSuccess = computeDigest(HashAlgorithmSha256, utf8Content.data(), utf8Content.length(), digest);
     if (!digestSuccess) {
         return "sha256-...";
     }
 
     return "sha256-" + base64Encode(reinterpret_cast<char*>(digest.data()), digest.size(), Base64DoNotInsertLFs);
 }
 
 }
 
 CSPDirectiveList::CSPDirectiveList(ContentSecurityPolicy* policy, ContentSecurityPolicyHeaderType type, ContentSecurityPolicyHeaderSource source)
@@ skipping 756 matching lines @@
         setCSPDirective<SourceListDirective>(name, value, m_manifestSrc);
     } else if (RuntimeEnabledFeatures::suboriginsEnabled() && equalIgnoringCase(name, ContentSecurityPolicy::Suborigin)) {
         applySuboriginPolicy(name, value);
     } else {
         m_policy->reportUnsupportedDirective(name);
     }
 }
 
 
 } // namespace blink