Implement the `require-sri-for` CSP directive

third_party/WebKit/Source/core/workers/AbstractWorker.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 29 matching lines @@
 
 AbstractWorker::AbstractWorker(ExecutionContext* context)
     : ActiveDOMObject(context)
 {
 }
 
 AbstractWorker::~AbstractWorker()
 {
 }
 
-KURL AbstractWorker::resolveURL(const String& url, ExceptionState& exceptionState)
+KURL AbstractWorker::resolveURL(const String& url, ExceptionState& exceptionState, WebURLRequest::RequestContext requestContext)
 {
     // FIXME: This should use the dynamic global scope (bug #27887)
     KURL scriptURL = getExecutionContext()->completeURL(url);
     if (!scriptURL.isValid()) {
         exceptionState.throwDOMException(SyntaxError, "'" + url + "' is not a valid URL.");
         return KURL();
     }
 
     // We can safely expose the URL in the following exceptions, as these checks happen synchronously before redirection. JavaScript receives no new information.
     if (!getExecutionContext()->getSecurityOrigin()->canRequestNoSuborigin(scriptURL)) {
         exceptionState.throwSecurityError("Script at '" + scriptURL.elidedString() + "' cannot be accessed from origin '" + getExecutionContext()->getSecurityOrigin()->toString() + "'.");
         return KURL();
     }
 
-    if (getExecutionContext()->contentSecurityPolicy() && !getExecutionContext()->contentSecurityPolicy()->allowWorkerContextFromSource(scriptURL)) {
+    if (getExecutionContext()->contentSecurityPolicy()
+        && !(getExecutionContext()->contentSecurityPolicy()->allowRequestWithoutIntegrity(requestContext, scriptURL)
+            && getExecutionContext()->contentSecurityPolicy()->allowWorkerContextFromSource(scriptURL))) {
         exceptionState.throwSecurityError("Access to the script at '" + scriptURL.elidedString() + "' is denied by the document's Content Security Policy.");
         return KURL();
     }
 
     return scriptURL;
 }
 
 DEFINE_TRACE(AbstractWorker)
 {
     EventTargetWithInlineData::trace(visitor);
     ActiveDOMObject::trace(visitor);
 }
 
 } // namespace blink