Implementation of W3C compliant CSP script-src nonce.

Source/core/loader/ResourceLoader.cpp

Index: Source/core/loader/ResourceLoader.cpp
diff --git a/Source/core/loader/ResourceLoader.cpp b/Source/core/loader/ResourceLoader.cpp
index 16faac7d0684a9a67787c7388ae4b0228fc83ac5..fd7e7a305b70480ffdd4b2b45566b6a4b9186582 100644
--- a/Source/core/loader/ResourceLoader.cpp
+++ b/Source/core/loader/ResourceLoader.cpp
@@ -323,7 +323,8 @@ void ResourceLoader::willSendRequest(ResourceHandle*, ResourceRequest& request,
 
     ASSERT(!request.isNull());
     if (!redirectResponse.isNull()) {
-        if (!m_documentLoader->cachedResourceLoader()->canRequest(m_resource->type(), request.url())) {
+        if
+        (!m_documentLoader->cachedResourceLoader()->canRequest(m_resource->type(), request.url(), NULL)) {

[abarth-chromium, 2013/05/14 21:11:08]

These two lines should be merged.

Also, we don't use NULL as a constant.  We use 0 instead.  :)

Why is 0 the right thing to pass here?  Does that mean we'll incorrectly block a
request if there's a redirect?  Specifically, if there's a <script nonce="..."
src="..."> and the we get a redirect, is the script still allowed?  In any case,
please add a test for this case.

[jww, 2013/05/14 22:55:30]

Can you elaborate on the example you're concerned about? I don't understand the
redirect issue you want me to test.

On 2013/05/14 21:11:08, abarth wrote:

             cancel();
             return;
         }