Part 3.3: Is policy list subsumed under subsuming policy?

third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPDirectiveList.h"
 
 #include "bindings/core/v8/SourceLocation.h"
 #include "core/dom/Document.h"
 #include "core/dom/SecurityContext.h"
 #include "core/dom/SpaceSplitString.h"
@@ skipping 145 matching lines @@
   }
   m_policy->reportViolation(directiveText, effectiveType, message, blockedURL,
                             m_reportEndpoints, m_header, m_headerType,
                             ContentSecurityPolicy::EvalViolation);
 }
 
 bool CSPDirectiveList::checkEval(SourceListDirective* directive) const {
   return !directive || directive->allowEval();
 }
 
-bool CSPDirectiveList::checkInline(SourceListDirective* directive) const {
-  return !directive ||
-         (directive->allowInline() && !directive->isHashOrNoncePresent());
-}
-
 bool CSPDirectiveList::isMatchingNoncePresent(SourceListDirective* directive,
                                               const String& nonce) const {
   return directive && directive->allowNonce(nonce);
 }
 
 bool CSPDirectiveList::checkHash(SourceListDirective* directive,
                                  const CSPHashValue& hashValue) const {
   return !directive || directive->allowHash(hashValue);
 }
 
@@ skipping 197 matching lines @@
 }
 
 bool CSPDirectiveList::checkInlineAndReportViolation(
     SourceListDirective* directive,
     const String& consoleMessage,
     Element* element,
     const String& contextURL,
     const WTF::OrdinalNumber& contextLine,
     bool isScript,
     const String& hashValue) const {
-  if (checkInline(directive))
+  if (!directive || directive->allowAllInline())
     return true;
 
   String suffix = String();
   if (directive->allowInline() && directive->isHashOrNoncePresent()) {
     // If inline is allowed, but a hash or nonce is present, we ignore
     // 'unsafe-inline'. Throw a reasonable error.
     suffix =
         " Note that 'unsafe-inline' is ignored if either a hash or nonce value "
         "is present in the source list.";
   } else {
@@ skipping 101 matching lines @@
                                directive->text() + "\".",
                            url, frame);
   return denyIfEnforcingPolicy();
 }
 
 bool CSPDirectiveList::allowJavaScriptURLs(
     Element* element,
     const String& contextURL,
     const WTF::OrdinalNumber& contextLine,
     ContentSecurityPolicy::ReportingStatus reportingStatus) const {
+  SourceListDirective* directive = operativeDirective(m_scriptSrc.get());
   if (reportingStatus == ContentSecurityPolicy::SendReport) {
     return checkInlineAndReportViolation(
-        operativeDirective(m_scriptSrc.get()),
+        directive,
         "Refused to execute JavaScript URL because it violates the following "
         "Content Security Policy directive: ",
         element, contextURL, contextLine, true, "sha256-...");
   }
-  return checkInline(operativeDirective(m_scriptSrc.get()));
+
+  return !directive || directive->allowAllInline();
 }
 
 bool CSPDirectiveList::allowInlineEventHandlers(
     Element* element,
     const String& contextURL,
     const WTF::OrdinalNumber& contextLine,
     ContentSecurityPolicy::ReportingStatus reportingStatus) const {
+  SourceListDirective* directive = operativeDirective(m_scriptSrc.get());
   if (reportingStatus == ContentSecurityPolicy::SendReport) {
     return checkInlineAndReportViolation(
         operativeDirective(m_scriptSrc.get()),
         "Refused to execute inline event handler because it violates the "
         "following Content Security Policy directive: ",
         element, contextURL, contextLine, true, "sha256-...");
   }
-  return checkInline(operativeDirective(m_scriptSrc.get()));
+
+  return !directive || directive->allowAllInline();
 }
 
 bool CSPDirectiveList::allowInlineScript(
     Element* element,
     const String& contextURL,
     const String& nonce,
     const WTF::OrdinalNumber& contextLine,
     ContentSecurityPolicy::ReportingStatus reportingStatus,
     const String& content) const {
-  if (isMatchingNoncePresent(operativeDirective(m_scriptSrc.get()), nonce))
+  SourceListDirective* directive = operativeDirective(m_scriptSrc.get());
+  if (isMatchingNoncePresent(directive, nonce))
     return true;
   if (element && isHTMLScriptElement(element) &&
       !toHTMLScriptElement(element)->loader()->isParserInserted() &&
       allowDynamic()) {
     return true;
   }
   if (reportingStatus == ContentSecurityPolicy::SendReport) {
     return checkInlineAndReportViolation(
-        operativeDirective(m_scriptSrc.get()),
+        directive,
         "Refused to execute inline script because it violates the following "
         "Content Security Policy directive: ",
         element, contextURL, contextLine, true, getSha256String(content));
   }
-  return checkInline(operativeDirective(m_scriptSrc.get()));
+
+  return !directive || directive->allowAllInline();
 }
 
 bool CSPDirectiveList::allowInlineStyle(
     Element* element,
     const String& contextURL,
     const String& nonce,
     const WTF::OrdinalNumber& contextLine,
     ContentSecurityPolicy::ReportingStatus reportingStatus,
     const String& content) const {
-  if (isMatchingNoncePresent(operativeDirective(m_styleSrc.get()), nonce))
+  SourceListDirective* directive = operativeDirective(m_styleSrc.get());
+  if (isMatchingNoncePresent(directive, nonce))
     return true;
   if (reportingStatus == ContentSecurityPolicy::SendReport) {
     return checkInlineAndReportViolation(
-        operativeDirective(m_styleSrc.get()),
+        directive,
         "Refused to apply inline style because it violates the following "
         "Content Security Policy directive: ",
         element, contextURL, contextLine, false, getSha256String(content));
   }
-  return checkInline(operativeDirective(m_styleSrc.get()));
+
+  return !directive || directive->allowAllInline();
 }
 
 bool CSPDirectiveList::allowEval(
     ScriptState* scriptState,
     ContentSecurityPolicy::ReportingStatus reportingStatus,
     ContentSecurityPolicy::ExceptionStatus exceptionStatus) const {
   if (reportingStatus == ContentSecurityPolicy::SendReport) {
     return checkEvalAndReportViolation(
         operativeDirective(m_scriptSrc.get()),
         "Refused to evaluate a string as JavaScript because 'unsafe-eval' is "
@@ skipping 689 matching lines @@
   visitor->trace(m_imgSrc);
   visitor->trace(m_mediaSrc);
   visitor->trace(m_manifestSrc);
   visitor->trace(m_objectSrc);
   visitor->trace(m_scriptSrc);
   visitor->trace(m_styleSrc);
   visitor->trace(m_workerSrc);
 }
 
 }  // namespace blink