Ship the 'unsafe-dynamic' CSP source expression.

third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPDirectiveList.h"
 
 #include "core/dom/Document.h"
 #include "core/dom/SecurityContext.h"
 #include "core/dom/SpaceSplitString.h"
 #include "core/frame/LocalFrame.h"
@@ skipping 114 matching lines @@
     return !directive || directive->allowNonce(nonce);
 }
 
 bool CSPDirectiveList::checkHash(SourceListDirective* directive, const CSPHashValue& hashValue) const
 {
     return !directive || directive->allowHash(hashValue);
 }
 
 bool CSPDirectiveList::checkDynamic(SourceListDirective* directive) const
 {
-    if (!m_policy->experimentalFeaturesEnabled())
-        return false;
     return !directive || directive->allowDynamic();
 }
 
 bool CSPDirectiveList::checkSource(SourceListDirective* directive, const KURL& url, ContentSecurityPolicy::RedirectStatus redirectStatus) const
 {
     // If |url| is empty, fall back to the policy URL to ensure that <object>'s
     // without a `src` can be blocked/allowed, as they can still load plugins
     // even though they don't actually have a URL.
     return !directive || directive->allows(url.isEmpty() ? m_policy->url() : url, redirectStatus);
 }
@@ skipping 682 matching lines @@
     visitor->trace(m_imgSrc);
     visitor->trace(m_mediaSrc);
     visitor->trace(m_manifestSrc);
     visitor->trace(m_objectSrc);
     visitor->trace(m_scriptSrc);
     visitor->trace(m_styleSrc);
 }
 
 
 } // namespace blink