CSP: Fix 'strict-dynamic' with multiple policies.

third_party/WebKit/Source/core/dom/ScriptLoader.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights
  * reserved.
  * Copyright (C) 2008 Nikolas Zimmermann <zimmermann@kde.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 327 matching lines @@
         ResourceRequest(elementDocument->completeURL(sourceUrl)),
         m_element->localName());
 
     CrossOriginAttributeValue crossOrigin = crossOriginAttributeValue(
         m_element->fastGetAttribute(HTMLNames::crossoriginAttr));
     if (crossOrigin != CrossOriginAttributeNotSet)
       request.setCrossOriginAccessControl(elementDocument->getSecurityOrigin(),
                                           crossOrigin);
     request.setCharset(scriptCharset());
 
-    // Skip fetch-related CSP checks if dynamically injected script is
-    // whitelisted and this script is not parser-inserted.
-    bool scriptPassesCSPDynamic =
-        (!isParserInserted() &&
-         elementDocument->contentSecurityPolicy()->allowDynamic());
-
-    if (ContentSecurityPolicy::isNonceableElement(m_element.get()))
+    if (ContentSecurityPolicy::isNonceableElement(m_element.get())) {
       request.setContentSecurityPolicyNonce(
           m_element->fastGetAttribute(HTMLNames::nonceAttr));
+    }
 
-    if (scriptPassesCSPDynamic) {
-      UseCounter::count(elementDocument->frame(),
-                        UseCounter::ScriptPassesCSPDynamic);
-      request.setContentSecurityCheck(DoNotCheckContentSecurityPolicy);
-    }
+    request.setParserDisposition(isParserInserted() ? ParserInserted
+                                                    : NotParserInserted);
+
     request.setDefer(defer);
 
     String integrityAttr =
         m_element->fastGetAttribute(HTMLNames::integrityAttr);
     if (!integrityAttr.isEmpty()) {
       IntegrityMetadataSet metadataSet;
       SubresourceIntegrity::parseIntegrityAttribute(integrityAttr, metadataSet,
                                                     elementDocument);
       request.setIntegrityMetadata(metadataSet);
     }
@@ skipping 280 matching lines @@
   if (isHTMLScriptLoader(element))
     return toHTMLScriptElement(element)->loader();
 
   if (isSVGScriptLoader(element))
     return toSVGScriptElement(element)->loader();
 
   return 0;
 }
 
 }  // namespace blink