Implementation of W3C compliant CSP script-src nonce.

Source/core/dom/ScriptElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nikolas Zimmermann <zimmermann@kde.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 236 matching lines @@
     return true;
 }
 
 bool ScriptElement::requestScript(const String& sourceUrl)
 {
     RefPtr<Document> originalDocument = m_element->document();
     if (!m_element->dispatchBeforeLoadEvent(sourceUrl))
         return false;
     if (!m_element->inDocument() || m_element->document() != originalDocument)
         return false;
-    if (!m_element->document()->contentSecurityPolicy()->allowScriptNonce(m_element->fastGetAttribute(HTMLNames::nonceAttr), m_element->document()->url(), m_startLineNumber, m_element->document()->completeURL(sourceUrl)))
-        return false;
 
     ASSERT(!m_cachedScript);
     if (!stripLeadingAndTrailingHTMLSpaces(sourceUrl).isEmpty()) {
         CachedResourceRequest request(ResourceRequest(m_element->document()->completeURL(sourceUrl)));
 
         String crossOriginMode = m_element->fastGetAttribute(HTMLNames::crossoriginAttr);
         if (!crossOriginMode.isNull()) {
             m_requestUsesAccessControl = true;
             StoredCredentials allowCredentials = equalIgnoringCase(crossOriginMode, "use-credentials") ? AllowStoredCredentials : DoNotAllowStoredCredentials;
             updateRequestForAccessControl(request.mutableResourceRequest(), m_element->document()->securityOrigin(), allowCredentials);
         }
         request.setCharset(scriptCharset());
         request.setInitiator(element());
 
+        bool isValidScriptNonce = m_element->document()->contentSecurityPolicy()->allowScriptNonce(request.initiatorElement()->fastGetAttribute(HTMLNames::nonceAttr));

[abarth-chromium, 2013/05/16 21:09:16]

There's no reason to use the initiator element.  We can just use m_element. 
We're about to remove initiatorElement.

[jww, 2013/05/16 21:37:46]

Done.

+        if (isValidScriptNonce)
+            request.setContentSecurityCheck(DoNotCheckContentSecurityPolicy);
+
         m_cachedScript = m_element->document()->cachedResourceLoader()->requestScript(request);
         m_isExternalScript = true;
     }
 
     if (m_cachedScript) {
         return true;
     }
 
     dispatchErrorEvent();
     return false;
 }
 
 void ScriptElement::executeScript(const ScriptSourceCode& sourceCode)
 {
     ASSERT(m_alreadyStarted);
 
     if (sourceCode.isEmpty())
         return;
 
     RefPtr<Document> document = m_element->document();
     Frame* frame = document->frame();
 
     bool shouldBypassMainWorldContentSecurityPolicy = (frame && frame->script()->shouldBypassMainWorldContentSecurityPolicy());
-    if (!shouldBypassMainWorldContentSecurityPolicy && !document->contentSecurityPolicy()->allowScriptNonce(m_element->fastGetAttribute(HTMLNames::nonceAttr), document->url(), m_startLineNumber))
-        return;
 
-    if (!m_isExternalScript && (!shouldBypassMainWorldContentSecurityPolicy && !document->contentSecurityPolicy()->allowInlineScript(document->url(), m_startLineNumber)))
+    bool isValidScriptNonce = document->contentSecurityPolicy()->allowScriptNonce(m_element->fastGetAttribute(HTMLNames::nonceAttr));
+    if (!m_isExternalScript && (!shouldBypassMainWorldContentSecurityPolicy && !(isValidScriptNonce || document->contentSecurityPolicy()->allowInlineScript(document->url(), m_startLineNumber))))

[abarth-chromium, 2013/05/16 21:09:16]

We should treat shouldBypassMainWorldContentSecurityPolicy and
isValidScriptNonce the same typographically since they're treated the same
operationally.

[jww, 2013/05/16 21:37:46]

I'm sure what you mean here. I *think* what you're saying is merge the
isValidScriptNonce check into the shouldBypassMainWorldContentSecurityPolicy
value, similar to what you suggest in a later comment. This is what I put into
the patch, so let me know if I misunderstood.
On 2013/05/16 21:09:16, abarth wrote:

         return;
 
     if (m_isExternalScript && m_cachedScript && !m_cachedScript->mimeTypeAllowedByNosniff()) {
         document->addConsoleMessage(SecurityMessageSource, ErrorMessageLevel, "Refused to execute script from '" + m_cachedScript->url().elidedString() + "' because its MIME type ('" + m_cachedScript->mimeType() + "') is not executable, and strict MIME type checking is enabled.");
         return;
     }
 
     if (frame) {
         {
             IgnoreDestructiveWriteCountIncrementer ignoreDesctructiveWriteCountIncrementer(m_isExternalScript ? document.get() : 0);
@@ skipping 112 matching lines @@
 
 #if ENABLE(SVG)
     if (element->isSVGElement() && element->hasTagName(SVGNames::scriptTag))
         return static_cast<SVGScriptElement*>(element);
 #endif
 
     return 0;
 }
 
 }