CSP: Fix 'strict-dynamic' with multiple policies.

third_party/WebKit/Source/core/dom/ScriptLoader.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights
  * reserved.
  * Copyright (C) 2008 Nikolas Zimmermann <zimmermann@kde.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 327 matching lines @@
         ResourceRequest(elementDocument->completeURL(sourceUrl)),
         m_element->localName());
 
     CrossOriginAttributeValue crossOrigin = crossOriginAttributeValue(
         m_element->fastGetAttribute(HTMLNames::crossoriginAttr));
     if (crossOrigin != CrossOriginAttributeNotSet)
       request.setCrossOriginAccessControl(elementDocument->getSecurityOrigin(),
                                           crossOrigin);
     request.setCharset(scriptCharset());
 
-    // Skip fetch-related CSP checks if dynamically injected script is
-    // whitelisted and this script is not parser-inserted.
-    bool scriptPassesCSPDynamic =
-        (!isParserInserted() &&
-         elementDocument->contentSecurityPolicy()->allowDynamic());
-
-    if (ContentSecurityPolicy::isNonceableElement(m_element.get()))
+    if (ContentSecurityPolicy::isNonceableElement(m_element.get())) {
       request.setContentSecurityPolicyNonce(
           m_element->fastGetAttribute(HTMLNames::nonceAttr));
+    }
 
-    if (scriptPassesCSPDynamic) {
-      UseCounter::count(elementDocument->frame(),
-                        UseCounter::ScriptPassesCSPDynamic);
-      request.setContentSecurityCheck(DoNotCheckContentSecurityPolicy);
-    }
+    request.setParserDisposition(isParserInserted() ? ParserInserted
+                                                    : NotParserInserted);
+
     request.setDefer(defer);
 
     String integrityAttr =
         m_element->fastGetAttribute(HTMLNames::integrityAttr);
     if (!integrityAttr.isEmpty()) {
       IntegrityMetadataSet metadataSet;
       SubresourceIntegrity::parseIntegrityAttribute(integrityAttr, metadataSet,
                                                     elementDocument);
       request.setIntegrityMetadata(metadataSet);
     }
@@ skipping 86 matching lines @@
   Document* contextDocument = elementDocument->contextDocument();
   if (!contextDocument)
     return true;
 
   LocalFrame* frame = contextDocument->frame();
 
   const ContentSecurityPolicy* csp = elementDocument->contentSecurityPolicy();
   bool shouldBypassMainWorldCSP =
       (frame && frame->script().shouldBypassMainWorldCSP()) ||
       csp->allowScriptWithHash(sourceCode.source(),
-                               ContentSecurityPolicy::InlineType::Block) ||
-      (!isParserInserted() && csp->allowDynamic());
+                               ContentSecurityPolicy::InlineType::Block);
+
+  ParserDisposition parserDisposition =
+      isParserInserted() ? ParserInserted : NotParserInserted;
 
   AtomicString nonce =
       ContentSecurityPolicy::isNonceableElement(m_element.get())
           ? m_element->fastGetAttribute(HTMLNames::nonceAttr)
           : AtomicString();
   if (!m_isExternalScript &&
       (!shouldBypassMainWorldCSP &&
-       !csp->allowInlineScript(elementDocument->url(), nonce, m_startLineNumber,
-                               sourceCode.source()))) {
+       !csp->allowInlineScript(elementDocument->url(), nonce, parserDisposition,
+                               m_startLineNumber, sourceCode.source()))) {
     return false;
   }
 
   if (m_isExternalScript) {
     ScriptResource* resource =
         m_resource ? m_resource.get() : sourceCode.resource();
     if (resource) {
       if (!resource->mimeTypeAllowedByNosniff()) {
         contextDocument->addConsoleMessage(ConsoleMessage::create(
             SecurityMessageSource, ErrorMessageLevel,
@@ skipping 163 matching lines @@
   if (isHTMLScriptLoader(element))
     return toHTMLScriptElement(element)->loader();
 
   if (isSVGScriptLoader(element))
     return toSVGScriptElement(element)->loader();
 
   return 0;
 }
 
 }  // namespace blink