CSP: Experimentally harden against nonce-stealing injections.

third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.h

 /*
  * Copyright (C) 2011 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 39 matching lines @@
 class OrdinalNumber;
 }
 
 namespace blink {
 
 class ContentSecurityPolicyResponseHeaders;
 class ConsoleMessage;
 class CSPDirectiveList;
 class CSPSource;
 class Document;
+class Element;
 class FrameLoaderClient;
 class KURL;
 class ResourceRequest;
 class SecurityOrigin;
 
 typedef int SandboxFlags;
 typedef HeapVector<Member<CSPDirectiveList>> CSPDirectiveListVector;
 typedef HeapVector<Member<ConsoleMessage>> ConsoleMessageVector;
 typedef std::pair<String, ContentSecurityPolicyHeaderType> CSPHeaderAndType;
 using RedirectStatus = ResourceRequest::RedirectStatus;
@@ skipping 203 matching lines @@
     bool selfMatchesInnerURL() const;
 
     bool experimentalFeaturesEnabled() const;
 
     bool shouldSendCSPHeader(Resource::Type) const;
 
     static bool shouldBypassMainWorld(const ExecutionContext*);
 
     static bool isDirectiveName(const String&);
 
+    static bool isNonceableElement(const Element*);
+
     Document* document() const;
 
 private:
     FRIEND_TEST_ALL_PREFIXES(ContentSecurityPolicyTest, NonceInline);
     FRIEND_TEST_ALL_PREFIXES(ContentSecurityPolicyTest, NonceSinglePolicy);
     FRIEND_TEST_ALL_PREFIXES(ContentSecurityPolicyTest, NonceMultiplePolicy);
 
     ContentSecurityPolicy();
 
     void applyPolicySideEffectsToExecutionContext();
@@ skipping 27 matching lines @@
     String m_disableEvalErrorMessage;
     WebInsecureRequestPolicy m_insecureRequestPolicy;
 
     Member<CSPSource> m_selfSource;
     String m_selfProtocol;
 };
 
 } // namespace blink
 
 #endif