CSP: Allow hashed inline event handlers only with 'unsafe-hashed-attributes'

third_party/WebKit/Source/core/frame/csp/CSPSourceList.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPSourceList.h"
 
 #include "core/frame/csp/CSPSource.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "platform/ParsingUtilities.h"
 #include "platform/weborigin/KURL.h"
@@ skipping 21 matching lines @@
 }
 
 CSPSourceList::CSPSourceList(ContentSecurityPolicy* policy, const String& directiveName)
     : m_policy(policy)
     , m_directiveName(directiveName)
     , m_allowSelf(false)
     , m_allowStar(false)
     , m_allowInline(false)
     , m_allowEval(false)
     , m_allowDynamic(false)
+    , m_allowHashedAttributes(false)
     , m_hashAlgorithmsUsed(0)
 {
 }
 
 bool CSPSourceList::matches(const KURL& url, ContentSecurityPolicy::RedirectStatus redirectStatus) const
 {
     // The CSP spec specifically states that data:, blob:, and filesystem URLs
     // should not be captured by a '*" source
     // (http://www.w3.org/TR/CSP2/#source-list-guid-matching). Thus, in the
     // case of a full wildcard, data:, blob:, and filesystem: URLs are
@@ skipping 30 matching lines @@
 bool CSPSourceList::allowNonce(const String& nonce) const
 {
     return !nonce.isNull() && m_nonces.contains(nonce);
 }
 
 bool CSPSourceList::allowHash(const CSPHashValue& hashValue) const
 {
     return m_hashes.contains(hashValue);
 }
 
+bool CSPSourceList::allowHashedAttributes() const
+{
+    return m_allowHashedAttributes;
+}
+
 uint8_t CSPSourceList::hashAlgorithmsUsed() const
 {
     return m_hashAlgorithmsUsed;
 }
 
 bool CSPSourceList::isHashOrNoncePresent() const
 {
     return !m_nonces.isEmpty() || m_hashAlgorithmsUsed != ContentSecurityPolicyHashAlgorithmNone;
 }
 
@@ skipping 66 matching lines @@
     if (equalIgnoringCase("'unsafe-eval'", begin, end - begin)) {
         addSourceUnsafeEval();
         return true;
     }
 
     if (equalIgnoringCase("'unsafe-dynamic'", begin, end - begin)) {
         addSourceUnsafeDynamic();
         return true;
     }
 
+    if (equalIgnoringCase("'unsafe-hashed-attributes'", begin, end - begin)) {
+        addSourceUnsafeHashedAttributes();
+        return true;
+    }
+
     String nonce;
     if (!parseNonce(begin, end, nonce))
         return false;
 
     if (!nonce.isNull()) {
         addSourceNonce(nonce);
         return true;
     }
 
     DigestValue hash;
@@ skipping 302 matching lines @@
 void CSPSourceList::addSourceUnsafeEval()
 {
     m_allowEval = true;
 }
 
 void CSPSourceList::addSourceUnsafeDynamic()
 {
     m_allowDynamic = true;
 }
 
+void CSPSourceList::addSourceUnsafeHashedAttributes()
+{
+    m_allowHashedAttributes = true;
+}
+
 void CSPSourceList::addSourceNonce(const String& nonce)
 {
     m_nonces.add(nonce);
 }
 
 void CSPSourceList::addSourceHash(const ContentSecurityPolicyHashAlgorithm& algorithm, const DigestValue& hash)
 {
     m_hashes.add(CSPHashValue(algorithm, hash));
     m_hashAlgorithmsUsed |= algorithm;
 }
 
 bool CSPSourceList::hasSourceMatchInList(const KURL& url, ContentSecurityPolicy::RedirectStatus redirectStatus) const
 {
     for (size_t i = 0; i < m_list.size(); ++i) {
         if (m_list[i]->matches(url, redirectStatus))
             return true;
     }
 
     return false;
 }
 
 DEFINE_TRACE(CSPSourceList)
 {
     visitor->trace(m_policy);
     visitor->trace(m_list);
 }
 
 } // namespace blink