Implementation of W3C compliant CSP script-src nonce.

Source/core/page/DOMSecurityPolicy.cpp

 /*
  * Copyright (C) 2012 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 52 matching lines @@
     if (!isPolicyActiveInContext(context))
         return true;
 
     KURL parsedURL = context->completeURL(url);
     if (!parsedURL.isValid())
         return false; // FIXME: Figure out how to throw a JavaScript error.
 
     return (context->contentSecurityPolicy()->*allowWithURL)(parsedURL, ContentSecurityPolicy::SuppressReport);
 }
 
+template<bool (ContentSecurityPolicy::*allowWithURLAndNonce)(const KURL&, bool, ContentSecurityPolicy::ReportingStatus) const>
+bool isAllowedWithURLAndNonce(ScriptExecutionContext* context, const String& url, bool validNonce)
+{
+    if (!isPolicyActiveInContext(context))
+        return true;
+
+    KURL parsedURL = context->completeURL(url);
+    if (!parsedURL.isValid())
+        return false; // FIXME: Figure out how to throw a JavaScript error.
+
+    return (context->contentSecurityPolicy()->*allowWithURLAndNonce)(parsedURL, validNonce, ContentSecurityPolicy::SuppressReport);
+}
+
+template<bool (ContentSecurityPolicy::*allowWithNonce)(bool, const String&, const WTF::OrdinalNumber&, ContentSecurityPolicy::ReportingStatus) const>
+bool isAllowedWithNonce(ScriptExecutionContext* context, bool validNonce)
+{
+    if (!isPolicyActiveInContext(context))
+        return true;
+
+    return (context->contentSecurityPolicy()->*allowWithNonce)(validNonce, String(), WTF::OrdinalNumber::beforeFirst(), ContentSecurityPolicy::SuppressReport);
+}

[abarth-chromium, 2013/05/16 00:59:27]

I don't understand why this code is needed.  Can we remove it?

[jww, 2013/05/16 20:59:00]

Done.

+
 template<bool (ContentSecurityPolicy::*allowWithContext)(const String&, const WTF::OrdinalNumber&, ContentSecurityPolicy::ReportingStatus) const>
 bool isAllowed(ScriptExecutionContext* context)
 {
     if (!isPolicyActiveInContext(context))
         return true;
 
     return (context->contentSecurityPolicy()->*allowWithContext)(String(), WTF::OrdinalNumber::beforeFirst(), ContentSecurityPolicy::SuppressReport);
 }
 
 } // namespace
@@ skipping 17 matching lines @@
     RefPtr<DOMStringList> result = DOMStringList::create();
 
     if (isActive())
         scriptExecutionContext()->contentSecurityPolicy()->gatherReportURIs(*result.get());
 
     return result.release();
 }
 
 bool DOMSecurityPolicy::allowsInlineScript() const
 {
-    return isAllowed<&ContentSecurityPolicy::allowInlineScript>(scriptExecutionContext());
+    return isAllowedWithNonce<&ContentSecurityPolicy::allowInlineScript>(scriptExecutionContext(), false);
 }
 
 bool DOMSecurityPolicy::allowsInlineStyle() const
 {
     return isAllowed<&ContentSecurityPolicy::allowInlineStyle>(scriptExecutionContext());
 }
 
 bool DOMSecurityPolicy::allowsEval() const
 {
     if (!isActive())
@@ skipping 38 matching lines @@
     return isAllowedWithURL<&ContentSecurityPolicy::allowObjectFromSource>(scriptExecutionContext(), url);
 }
 
 bool DOMSecurityPolicy::allowsPluginType(const String& type) const
 {
     return isAllowedWithType<&ContentSecurityPolicy::allowPluginType>(scriptExecutionContext(), type);
 }
 
 bool DOMSecurityPolicy::allowsScriptFrom(const String& url) const
 {
-    return isAllowedWithURL<&ContentSecurityPolicy::allowScriptFromSource>(scriptExecutionContext(), url);
+    return isAllowedWithURLAndNonce<&ContentSecurityPolicy::allowScriptFromSource>(scriptExecutionContext(), url, false);
 }
 
 bool DOMSecurityPolicy::allowsStyleFrom(const String& url) const
 {
     return isAllowedWithURL<&ContentSecurityPolicy::allowStyleFromSource>(scriptExecutionContext(), url);
 }
 
 } // namespace WebCore