Implementation of W3C compliant CSP script-src nonce.

Source/core/dom/ScriptElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nikolas Zimmermann <zimmermann@kde.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 236 matching lines @@
     return true;
 }
 
 bool ScriptElement::requestScript(const String& sourceUrl)
 {
     RefPtr<Document> originalDocument = m_element->document();
     if (!m_element->dispatchBeforeLoadEvent(sourceUrl))
         return false;
     if (!m_element->inDocument() || m_element->document() != originalDocument)
         return false;
-    if (!m_element->document()->contentSecurityPolicy()->allowScriptNonce(m_element->fastGetAttribute(HTMLNames::nonceAttr), m_element->document()->url(), m_startLineNumber, m_element->document()->completeURL(sourceUrl)))
-        return false;
 
     ASSERT(!m_cachedScript);
     if (!stripLeadingAndTrailingHTMLSpaces(sourceUrl).isEmpty()) {
         CachedResourceRequest request(ResourceRequest(m_element->document()->completeURL(sourceUrl)));
 
         String crossOriginMode = m_element->fastGetAttribute(HTMLNames::crossoriginAttr);
         if (!crossOriginMode.isNull()) {
             m_requestUsesAccessControl = true;
             StoredCredentials allowCredentials = equalIgnoringCase(crossOriginMode, "use-credentials") ? AllowStoredCredentials : DoNotAllowStoredCredentials;
             updateRequestForAccessControl(request.mutableResourceRequest(), m_element->document()->securityOrigin(), allowCredentials);
@@ skipping 17 matching lines @@
 {
     ASSERT(m_alreadyStarted);
 
     if (sourceCode.isEmpty())
         return;
 
     RefPtr<Document> document = m_element->document();
     Frame* frame = document->frame();
 
     bool shouldBypassMainWorldContentSecurityPolicy = (frame && frame->script()->shouldBypassMainWorldContentSecurityPolicy());
-    if (!shouldBypassMainWorldContentSecurityPolicy && !document->contentSecurityPolicy()->allowScriptNonce(m_element->fastGetAttribute(HTMLNames::nonceAttr), document->url(), m_startLineNumber))
-        return;
 
-    if (!m_isExternalScript && (!shouldBypassMainWorldContentSecurityPolicy && !document->contentSecurityPolicy()->allowInlineScript(document->url(), m_startLineNumber)))
+    bool validNonce = document->contentSecurityPolicy()->allowNonce(m_element->fastGetAttribute(HTMLNames::nonceAttr));

[abarth-chromium, 2013/05/16 00:59:27]

Maybe isValidNonceForScript?  Different types of resources can have different
nonces.

[jww, 2013/05/16 20:59:00]

Done.

+    if (!m_isExternalScript && (!shouldBypassMainWorldContentSecurityPolicy && !document->contentSecurityPolicy()->allowInlineScript(validNonce, document->url(), m_startLineNumber)))

[abarth-chromium, 2013/05/16 00:59:27]

Is there a reason to call allowInlineScript if the nonce is valid?  It seems
like we could just bypass the call.  It seems related to
shouldBypassMainWorldContentSecurityPolicy in that way.

[jww, 2013/05/16 20:59:00]

Sure, I can do this. I guess my thought was to keep as much contained within the
ContentSecurityPolicy class itself, but good point that
shouldBypassMainWorldContentSecurityPolicy already does this sort of thing.
On 2013/05/16 00:59:27, abarth wrote:

         return;
 
     if (m_isExternalScript && m_cachedScript && !m_cachedScript->mimeTypeAllowedByNosniff()) {
         document->addConsoleMessage(SecurityMessageSource, ErrorMessageLevel, "Refused to execute script from '" + m_cachedScript->url().elidedString() + "' because its MIME type ('" + m_cachedScript->mimeType() + "') is not executable, and strict MIME type checking is enabled.");
         return;
     }
 
     if (frame) {
         {
             IgnoreDestructiveWriteCountIncrementer ignoreDesctructiveWriteCountIncrementer(m_isExternalScript ? document.get() : 0);
@@ skipping 112 matching lines @@
 
 #if ENABLE(SVG)
     if (element->isSVGElement() && element->hasTagName(SVGNames::scriptTag))
         return static_cast<SVGScriptElement*>(element);
 #endif
 
     return 0;
 }
 
 }