CSP: Add an experimental 'unsafe-dynamic' source expression.

third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPDirectiveList.h"
 
 #include "core/dom/Document.h"
 #include "core/dom/SecurityContext.h"
 #include "core/dom/SpaceSplitString.h"
 #include "core/frame/LocalFrame.h"
@@ skipping 111 matching lines @@
 bool CSPDirectiveList::checkNonce(SourceListDirective* directive, const String& nonce) const
 {
     return !directive || directive->allowNonce(nonce);
 }
 
 bool CSPDirectiveList::checkHash(SourceListDirective* directive, const CSPHashValue& hashValue) const
 {
     return !directive || directive->allowHash(hashValue);
 }
 
+bool CSPDirectiveList::checkDynamic(SourceListDirective* directive) const
+{
+    return !directive || directive->allowDynamic();
+}
+
 bool CSPDirectiveList::checkSource(SourceListDirective* directive, const KURL& url, ContentSecurityPolicy::RedirectStatus redirectStatus) const
 {
     return !directive || directive->allows(url, redirectStatus);
 }
 
 bool CSPDirectiveList::checkAncestors(SourceListDirective* directive, LocalFrame* frame) const
 {
     if (!frame || !directive)
         return true;
 
@@ skipping 263 matching lines @@
 bool CSPDirectiveList::allowScriptHash(const CSPHashValue& hashValue) const
 {
     return checkHash(operativeDirective(m_scriptSrc.get()), hashValue);
 }
 
 bool CSPDirectiveList::allowStyleHash(const CSPHashValue& hashValue) const
 {
     return checkHash(operativeDirective(m_styleSrc.get()), hashValue);
 }
 
+bool CSPDirectiveList::allowDynamic() const
+{
+    return checkDynamic(operativeDirective(m_scriptSrc.get()));
+}
+
 const String& CSPDirectiveList::pluginTypesText() const
 {
     ASSERT(hasPluginTypes());
     return m_pluginTypes->text();
 }
 
 bool CSPDirectiveList::shouldSendCSPHeader(Resource::Type type) const
 {
     // TODO(mkwst): Revisit this once the CORS prefetch issue with the 'CSP'
     //              header is worked out, one way or another:
@@ skipping 369 matching lines @@
         setCSPDirective<SourceListDirective>(name, value, m_manifestSrc);
     } else if (RuntimeEnabledFeatures::suboriginsEnabled() && equalIgnoringCase(name, ContentSecurityPolicy::Suborigin)) {
         applySuboriginPolicy(name, value);
     } else {
         m_policy->reportUnsupportedDirective(name);
     }
 }
 
 
 } // namespace blink