Implement the `require-sri-for` CSP directive

third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.h

 /*
  * Copyright (C) 2011 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 87 matching lines @@
     // Mixed Content Directive
     // https://w3c.github.io/webappsec/specs/mixedcontent/#strict-mode
     static const char BlockAllMixedContent[];
 
     // https://w3c.github.io/webappsec/specs/upgrade/
     static const char UpgradeInsecureRequests[];
 
     // https://mikewest.github.io/cors-rfc1918/#csp
     static const char TreatAsPublicAddress[];
 
+    // https://w3c.github.io/webappsec-subresource-integrity/#require-sri-for
+    static const char RequireSRIFor[];
+
     enum ReportingStatus {
         SendReport,
         SuppressReport
     };
 
     enum ExceptionStatus {
         WillThrowException,
         WillNotThrowException
     };
 
@@ skipping 80 matching lines @@
     // Hash functions check all policies relating to use of a script/style
     // with the given hash and return true all CSP policies allow it.
     // If these return true, callers can then process the content or
     // issue a load and be safe disabling any further CSP checks.
     //
     // TODO(mkwst): Fold hashes into 'allow{Script,Style}' checks above, just
     // as we've done with nonces. https://crbug.com/617065
     bool allowScriptWithHash(const String& source, InlineType) const;
     bool allowStyleWithHash(const String& source, InlineType) const;
 
-    bool allowRequest(WebURLRequest::RequestContext, const KURL&, const String& nonce, RedirectStatus = RedirectStatus::NoRedirect, ReportingStatus = SendReport) const;
+    bool allowRequestWithoutIntegrity(WebURLRequest::RequestContext, const KURL&, RedirectStatus = RedirectStatus::NoRedirect, ReportingStatus = SendReport) const;
+
+    bool allowRequest(WebURLRequest::RequestContext, const KURL&, const String& nonce, const IntegrityMetadataSet&, RedirectStatus = RedirectStatus::NoRedirect, ReportingStatus = SendReport) const;
 
     void usesScriptHashAlgorithms(uint8_t ContentSecurityPolicyHashAlgorithm);
     void usesStyleHashAlgorithms(uint8_t ContentSecurityPolicyHashAlgorithm);
 
     ReflectedXSSDisposition getReflectedXSSDisposition() const;
 
     bool didSetReferrerPolicy() const;
 
     void setOverrideAllowInlineStyle(bool);
     void setOverrideURLForSelf(const KURL&);
 
     bool isActive() const;
 
     // If a frame is passed in, the message will be logged to its active document's console.
     // Otherwise, the message will be logged to this object's |m_executionContext|.
     void logToConsole(ConsoleMessage*, LocalFrame* = nullptr);
 
     void reportDirectiveAsSourceExpression(const String& directiveName, const String& sourceExpression);
     void reportDuplicateDirective(const String&);
     void reportInvalidDirectiveValueCharacter(const String& directiveName, const String& value);
     void reportInvalidPathCharacter(const String& directiveName, const String& value, const char);
     void reportInvalidPluginTypes(const String&);
+    void reportInvalidRequireSRIForTokens(const String&);
     void reportInvalidSandboxFlags(const String&);
     void reportInvalidSourceExpression(const String& directiveName, const String& source);
     void reportInvalidReflectedXSS(const String&);
     void reportMissingReportURI(const String&);
     void reportUnsupportedDirective(const String&);
     void reportInvalidInReportOnly(const String&);
     void reportInvalidDirectiveInMeta(const String& directiveName);
     void reportInvalidReferrer(const String&);
     void reportReportOnlyInMeta(const String&);
     void reportMetaOutsideHead(const String&);
@@ skipping 72 matching lines @@
     String m_disableEvalErrorMessage;
     SecurityContext::InsecureRequestsPolicy m_insecureRequestsPolicy;
 
     Member<CSPSource> m_selfSource;
     String m_selfProtocol;
 };
 
 } // namespace blink
 
 #endif