CSP: Allow hashed inline event handlers only with 'unsafe-hashed-attributes'

third_party/WebKit/Source/core/frame/csp/CSPSourceListTest.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPSourceList.h"
 
 #include "core/dom/Document.h"
 #include "core/frame/csp/CSPSource.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "platform/weborigin/KURL.h"
@@ skipping 44 matching lines @@
 
 TEST_F(CSPSourceListTest, BasicMatchingUnsafeDynamic)
 {
     String sources = "'unsafe-dynamic'";
     CSPSourceList sourceList(csp.get(), "script-src");
     parseSourceList(sourceList, sources);
 
     EXPECT_TRUE(sourceList.allowDynamic());
 }
 
+TEST_F(CSPSourceListTest, BasicMatchingUnsafeHashedAttributes)
+{
+    String sources = "'unsafe-hashed-attributes'";
+    CSPSourceList sourceList(csp.get(), "script-src");
+    parseSourceList(sourceList, sources);
+
+    EXPECT_TRUE(sourceList.allowHashedAttributes());
+}
+
+
 TEST_F(CSPSourceListTest, BasicMatchingStar)
 {
     KURL base;
     String sources = "*";
     CSPSourceList sourceList(csp.get(), "script-src");
     parseSourceList(sourceList, sources);
 
     EXPECT_TRUE(sourceList.matches(KURL(base, "http://example.com/")));
     EXPECT_TRUE(sourceList.matches(KURL(base, "https://example.com/")));
     EXPECT_TRUE(sourceList.matches(KURL(base, "http://example.com/bar")));
@@ skipping 106 matching lines @@
     EXPECT_TRUE(sourceList.matches(KURL(base, "http://example1.com/bar/"), ContentSecurityPolicy::DidRedirect));
     EXPECT_TRUE(sourceList.matches(KURL(base, "http://example2.com/bar/"), ContentSecurityPolicy::DidRedirect));
     EXPECT_TRUE(sourceList.matches(KURL(base, "http://example2.com/foo/"), ContentSecurityPolicy::DidRedirect));
     EXPECT_TRUE(sourceList.matches(KURL(base, "https://example1.com/foo/"), ContentSecurityPolicy::DidRedirect));
     EXPECT_TRUE(sourceList.matches(KURL(base, "https://example1.com/bar/"), ContentSecurityPolicy::DidRedirect));
 
     EXPECT_FALSE(sourceList.matches(KURL(base, "http://example3.com/foo/"), ContentSecurityPolicy::DidRedirect));
 }
 
 } // namespace blink