Implementation of W3C compliant CSP script-src nonce.

Source/core/page/DOMSecurityPolicy.cpp

 /*
  * Copyright (C) 2012 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 52 matching lines @@
     if (!isPolicyActiveInContext(context))
         return true;
 
     KURL parsedURL = context->completeURL(url);
     if (!parsedURL.isValid())
         return false; // FIXME: Figure out how to throw a JavaScript error.
 
     return (context->contentSecurityPolicy()->*allowWithURL)(parsedURL, ContentSecurityPolicy::SuppressReport);
 }
 
+template<bool (ContentSecurityPolicy::*allowWithURLAndNonce)(const KURL&, const String&, ContentSecurityPolicy::ReportingStatus) const>
+bool isAllowedWithURLAndNonce(ScriptExecutionContext* context, const String& url, const String& nonce)
+{
+    if (!isPolicyActiveInContext(context))
+        return true;
+
+    KURL parsedURL = context->completeURL(url);
+    if (!parsedURL.isValid())
+        return false; // FIXME: Figure out how to throw a JavaScript error.
+
+    return (context->contentSecurityPolicy()->*allowWithURLAndNonce)(parsedURL, nonce, ContentSecurityPolicy::SuppressReport);
+}
+
+template<bool (ContentSecurityPolicy::*allowWithNonce)(const String&, const String&, const WTF::OrdinalNumber&, ContentSecurityPolicy::ReportingStatus) const>
+bool isAllowedWithNonce(ScriptExecutionContext* context, const String& nonce)
+{
+    if (!isPolicyActiveInContext(context))
+        return true;
+
+    return (context->contentSecurityPolicy()->*allowWithNonce)(nonce, String(), WTF::OrdinalNumber::beforeFirst(), ContentSecurityPolicy::SuppressReport);
+}
+
 template<bool (ContentSecurityPolicy::*allowWithContext)(const String&, const WTF::OrdinalNumber&, ContentSecurityPolicy::ReportingStatus) const>
 bool isAllowed(ScriptExecutionContext* context)
 {
     if (!isPolicyActiveInContext(context))
         return true;
 
     return (context->contentSecurityPolicy()->*allowWithContext)(String(), WTF::OrdinalNumber::beforeFirst(), ContentSecurityPolicy::SuppressReport);
 }
-

[abarth-chromium, 2013/05/14 05:58:16]

You should leave this blank line.

[jww, 2013/05/14 20:49:30]

Done.

 } // namespace
 
 DOMSecurityPolicy::DOMSecurityPolicy(ScriptExecutionContext* context)
     : ContextDestructionObserver(context)
 {
 }
 
 DOMSecurityPolicy::~DOMSecurityPolicy()
 {
 }
 
 bool DOMSecurityPolicy::isActive() const
 {
     return isPolicyActiveInContext(scriptExecutionContext());
 }
 
 PassRefPtr<DOMStringList> DOMSecurityPolicy::reportURIs() const
 {
     RefPtr<DOMStringList> result = DOMStringList::create();
 
     if (isActive())
         scriptExecutionContext()->contentSecurityPolicy()->gatherReportURIs(*result.get());
 
     return result.release();
 }
 
 bool DOMSecurityPolicy::allowsInlineScript() const
 {
-    return isAllowed<&ContentSecurityPolicy::allowInlineScript>(scriptExecutionContext());
+    return isAllowedWithNonce<&ContentSecurityPolicy::allowInlineScript>(scriptExecutionContext(), String());
 }
 
 bool DOMSecurityPolicy::allowsInlineStyle() const
 {
     return isAllowed<&ContentSecurityPolicy::allowInlineStyle>(scriptExecutionContext());
 }
 
 bool DOMSecurityPolicy::allowsEval() const
 {
     if (!isActive())
@@ skipping 38 matching lines @@
     return isAllowedWithURL<&ContentSecurityPolicy::allowObjectFromSource>(scriptExecutionContext(), url);
 }
 
 bool DOMSecurityPolicy::allowsPluginType(const String& type) const
 {
     return isAllowedWithType<&ContentSecurityPolicy::allowPluginType>(scriptExecutionContext(), type);
 }
 
 bool DOMSecurityPolicy::allowsScriptFrom(const String& url) const
 {
-    return isAllowedWithURL<&ContentSecurityPolicy::allowScriptFromSource>(scriptExecutionContext(), url);
+    return isAllowedWithURLAndNonce<&ContentSecurityPolicy::allowScriptFromSource>(scriptExecutionContext(), url, String());
 }
 
 bool DOMSecurityPolicy::allowsStyleFrom(const String& url) const
 {
     return isAllowedWithURL<&ContentSecurityPolicy::allowStyleFromSource>(scriptExecutionContext(), url);
 }
 
 } // namespace WebCore