CSP: Allow hashed inline event handlers only with 'unsafe-hashed-attributes'

third_party/WebKit/Source/core/dom/StyleElement.cpp

 /*
  * Copyright (C) 2006, 2007 Rob Buis
  * Copyright (C) 2008 Apple, Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 156 matching lines @@
 }
 
 StyleElement::ProcessingResult StyleElement::createSheet(Element* e, const String& text)
 {
     DCHECK(e);
     DCHECK(e->inShadowIncludingDocument());
     Document& document = e->document();
 
     const ContentSecurityPolicy* csp = document.contentSecurityPolicy();
     bool passesContentSecurityPolicyChecks = shouldBypassMainWorldCSP(e)
-        || csp->allowStyleWithHash(text)
+        || csp->allowStyleWithHash(text, ContentSecurityPolicy::InlineType::Block)
         || csp->allowStyleWithNonce(e->fastGetAttribute(HTMLNames::nonceAttr))
         || csp->allowInlineStyle(e->document().url(), m_startPosition.m_line, text);
 
     // Clearing the current sheet may remove the cache entry so create the new sheet first
     CSSStyleSheet* newSheet = nullptr;
 
     // If type is empty or CSS, this is a CSS style sheet.
     const AtomicString& type = this->type();
     if (isCSS(e, type) && passesContentSecurityPolicyChecks) {
         MediaQuerySet* mediaQueries = MediaQuerySet::create(media());
@@ skipping 39 matching lines @@
 {
     document.styleEngine().addPendingSheet();
 }
 
 DEFINE_TRACE(StyleElement)
 {
     visitor->trace(m_sheet);
 }
 
 } // namespace blink