Fix SRI bypass by loading same resource twice in same origin.

third_party/WebKit/Source/core/dom/PendingScript.cpp

 /*
  * Copyright (C) 2010 Google, Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 132 matching lines @@
         ASSERT(resource->type() == Resource::Script);
         ScriptResource* scriptResource = toScriptResource(resource);
         String integrityAttr = m_element->fastGetAttribute(HTMLNames::integrityAttr);
 
         // It is possible to get back a script resource with integrity metadata
         // for a request with an empty integrity attribute. In that case, the
         // integrity check should be skipped, so this check ensures that the
         // integrity attribute isn't empty in addition to checking if the
         // resource has empty integrity metadata.
         if (!integrityAttr.isEmpty() && !scriptResource->integrityMetadata().isEmpty()) {
-            if (!scriptResource->integrityAlreadyChecked() && resource->resourceBuffer()) {
-                scriptResource->setIntegrityAlreadyChecked(true);
+            ScriptIntegrityDisposition disposition = scriptResource->integrityDisposition();
+            if (disposition == IntegrityFailed) {
+                // TODO(jww): This should probably also generate a console
+                // message identical to the one produced by
+                // CheckSubresourceIntegrity below.
+                m_integrityFailure = true;
+            } else if (disposition == IntegrityNotChecked && resource->resourceBuffer()) {
                 m_integrityFailure = !SubresourceIntegrity::CheckSubresourceIntegrity(scriptResource->integrityMetadata(), *m_element, resource->resourceBuffer()->data(), resource->resourceBuffer()->size(), resource->url(), *resource);
+                scriptResource->setIntegrityAlreadyChecked(!m_integrityFailure);

[dcheng, 2016/02/09 01:12:46]

I don't think it's obvious from the callsite that true/false maps to failed /
passed. Maybe just pass the enum value through?

(And ASSERT(m_integrityFailure != ScriptIntegrityDisposition::NotChecked) for
sanity if you want)

[jww, 2016/02/09 04:38:50]

Done.

             }
         }
     }
 
     if (m_streamer)
         m_streamer->notifyFinished(resource);
 }
 
 void PendingScript::notifyAppendData(ScriptResource* resource)
 {
@@ skipping 31 matching lines @@
 bool PendingScript::isReady() const
 {
     if (resource() && !resource()->isLoaded())
         return false;
     if (m_streamer && !m_streamer->isFinished())
         return false;
     return true;
 }
 
 } // namespace blink