Teach the preload scanner about the 'nonce' attribute.

third_party/WebKit/Source/core/html/parser/HTMLPreloadScannerTest.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/html/parser/HTMLPreloadScanner.h"
 
 #include "core/MediaTypeNames.h"
 #include "core/css/MediaValuesCached.h"
 #include "core/fetch/ClientHintsPreferences.h"
 #include "core/frame/Settings.h"
@@ skipping 26 matching lines @@
 struct ReferrerPolicyTestCase {
     const char* baseURL;
     const char* inputHTML;
     const char* preloadedURL; // Or nullptr if no preload is expected.
     const char* outputBaseURL;
     Resource::Type type;
     int resourceWidth;
     ReferrerPolicy referrerPolicy;
 };
 
+struct NonceTestCase {
+    const char* baseURL;
+    const char* inputHTML;
+    const char* nonce;
+};
+
 class MockHTMLResourcePreloader : public ResourcePreloader {
 public:
     void preloadRequestVerification(Resource::Type type, const char* url, const char* baseURL, int width, const ClientHintsPreferences& preferences)
     {
         if (!url) {
             EXPECT_FALSE(m_preloadRequest);
             return;
         }
         EXPECT_NE(nullptr, m_preloadRequest.get());
         if (m_preloadRequest) {
@@ skipping 16 matching lines @@
 
     void preconnectRequestVerification(const String& host, CrossOriginAttributeValue crossOrigin)
     {
         if (!host.isNull()) {
             EXPECT_TRUE(m_preloadRequest->isPreconnect());
             EXPECT_STREQ(m_preloadRequest->resourceURL().ascii().data(), host.ascii().data());
             EXPECT_EQ(m_preloadRequest->crossOrigin(), crossOrigin);
         }
     }
 
+    void nonceRequestVerification(const char* nonce)
+    {
+        ASSERT_TRUE(m_preloadRequest.get());
+        if (strlen(nonce))
+            EXPECT_EQ(nonce, m_preloadRequest->nonce());
+        else
+            EXPECT_TRUE(m_preloadRequest->nonce().isEmpty());
+    }
+
 protected:
     void preload(std::unique_ptr<PreloadRequest> preloadRequest, const NetworkHintsInterface&) override
     {
         m_preloadRequest = std::move(preloadRequest);
     }
 
 private:
     std::unique_ptr<PreloadRequest> m_preloadRequest;
 };
 
@@ skipping 71 matching lines @@
     void test(ReferrerPolicyTestCase testCase)
     {
         MockHTMLResourcePreloader preloader;
         KURL baseURL(ParsedURLString, testCase.baseURL);
         m_scanner->appendToEnd(String(testCase.inputHTML));
         m_scanner->scanAndPreload(&preloader, baseURL, nullptr);
 
         preloader.preloadRequestVerification(testCase.type, testCase.preloadedURL, testCase.outputBaseURL, testCase.resourceWidth, testCase.referrerPolicy);
     }
 
+    void test(NonceTestCase testCase)
+    {
+        MockHTMLResourcePreloader preloader;
+        KURL baseURL(ParsedURLString, testCase.baseURL);
+        m_scanner->appendToEnd(String(testCase.inputHTML));
+        m_scanner->scanAndPreload(&preloader, baseURL, nullptr);
+
+        preloader.nonceRequestVerification(testCase.nonce);
+    }
+
 private:
     std::unique_ptr<DummyPageHolder> m_dummyPageHolder;
     std::unique_ptr<HTMLPreloadScanner> m_scanner;
 };
 
 TEST_F(HTMLPreloadScannerTest, testImages)
 {
     TestCase testCases[] = {
         {"http://example.test", "<img src='bla.gif'>", "bla.gif", "http://example.test/", Resource::Image, 0},
         {"http://example.test", "<img srcset='bla.gif 320w, blabla.gif 640w'>", "blabla.gif", "http://example.test/", Resource::Image, 0},
@@ skipping 183 matching lines @@
         { "http://example.test", "<meta name='referrer' content='no-referrer'><img referrerpolicy='origin' src='bla.gif'/>", "bla.gif", "http://example.test/", Resource::Image, 0, ReferrerPolicyOrigin },
         // The scanner's state is not reset between test cases, so all subsequent test cases have a document referrer policy of no-referrer.
         { "http://example.test", "<img referrerpolicy='not-a-valid-policy' src='bla.gif'/>", "bla.gif", "http://example.test/", Resource::Image, 0, ReferrerPolicyNever },
         { "http://example.test", "<img src='bla.gif'/>", "bla.gif", "http://example.test/", Resource::Image, 0, ReferrerPolicyNever }
     };
 
     for (const auto& testCase : testCases)
         test(testCase);
 }
 
+TEST_F(HTMLPreloadScannerTest, testNonce)
+{
+    NonceTestCase testCases[] = {
+        { "http://example.test", "<script src='/script'></script>", "" },
+        { "http://example.test", "<script src='/script' nonce=''></script>", "" },
+        { "http://example.test", "<script src='/script' nonce='abc'></script>", "abc" },
+        { "http://example.test", "<link rel='import' href='/import'>", "" },
+        { "http://example.test", "<link rel='import' href='/import' nonce=''>", "" },
+        { "http://example.test", "<link rel='import' href='/import' nonce='abc'>", "abc" },
+        { "http://example.test", "<link rel='stylesheet' href='/style'>", "" },
+        { "http://example.test", "<link rel='stylesheet' href='/style' nonce=''>", "" },
+        { "http://example.test", "<link rel='stylesheet' href='/style' nonce='abc'>", "abc" },
+
+        // <img> doesn't support nonces:
+        { "http://example.test", "<img src='/image'>", "" },
+        { "http://example.test", "<img src='/image' nonce=''>", "" },
+        { "http://example.test", "<img src='/image' nonce='abc'>", "" },
+    };
+
+    for (const auto& testCase : testCases) {
+        SCOPED_TRACE(testCase.inputHTML);
+        test(testCase);
+    }
+}
+
 // Tests that a document-level referrer policy (e.g. one set by HTTP
 // header) is applied for preload requests.
 TEST_F(HTMLPreloadScannerTest, testReferrerPolicyOnDocument)
 {
     runSetUp(ViewportEnabled, PreloadEnabled, ReferrerPolicyOrigin);
     ReferrerPolicyTestCase testCases[] = {
         { "http://example.test", "<img src='blah.gif'/>", "blah.gif", "http://example.test/", Resource::Image, 0, ReferrerPolicyOrigin },
         { "http://example.test", "<style>@import url('blah.css');</style>", "blah.css", "http://example.test/", Resource::CSSStyleSheet, 0, ReferrerPolicyOrigin },
         // Tests that a meta-delivered referrer policy with an
         // unrecognized policy value does not override the document's
@@ skipping 21 matching lines @@
         {"http://example.test", "<link rel=preload href=bla as=track>", "bla", "http://example.test/", Resource::TextTrack, 0},
         {"http://example.test", "<link rel=preload href=bla as=image media=\"(max-width: 800px)\">", "bla", "http://example.test/", Resource::Image, 0},
         {"http://example.test", "<link rel=preload href=bla as=image media=\"(max-width: 400px)\">", nullptr, "http://example.test/", Resource::Image, 0},
     };
 
     for (const auto& testCase : testCases)
         test(testCase);
 }
 
 } // namespace blink