Part 3.3: Is policy list subsumed under subsuming policy?

third_party/WebKit/Source/core/frame/csp/SourceListDirective.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/SourceListDirective.h"
 
 #include "core/frame/csp/CSPSource.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "platform/network/ContentSecurityPolicyParsers.h"
 #include "platform/weborigin/KURL.h"
@@ skipping 561 matching lines @@
     const KURL& url,
     ResourceRequest::RedirectStatus redirectStatus) const {
   for (size_t i = 0; i < m_list.size(); ++i) {
     if (m_list[i]->matches(url, redirectStatus))
       return true;
   }
 
   return false;
 }
 
+bool SourceListDirective::allowAllInline() {
+  const ContentSecurityPolicy::DirectiveType& type =
+      ContentSecurityPolicy::getDirectiveType(m_directiveName);
+  if (type != ContentSecurityPolicy::DirectiveType::StyleSrc &&
+      type != ContentSecurityPolicy::DirectiveType::ScriptSrc) {
+    return false;
+  }
+  return m_allowInline && !isHashOrNoncePresent() &&

[Mike West, 2016/11/28 15:38:16]

Can we use this when responding to `allowInline()` in general? That is, it would
be nice if you integrated this into the main CSP check, as I don't think we're
currently ignoring `strict-dynamic` for things that aren't `script-src`.

[amalika, 2016/11/29 09:42:29]

Made changes to call allowAllInline with comments below!

+         (type != ContentSecurityPolicy::DirectiveType::ScriptSrc ||
+          !m_allowDynamic);
+}
+
 bool SourceListDirective::subsumes(
     HeapVector<Member<SourceListDirective>> other) {
   // TODO(amalika): Handle here special keywords.
   if (!m_list.size() || !other.size())
     return !m_list.size();
 
   HeapVector<Member<CSPSource>> normalizedA = m_list;
   if (m_allowSelf)
     normalizedA.append(m_policy->getSelfSource());
 
   HeapVector<Member<CSPSource>> normalizedB = other[0]->m_list;
   if (other[0]->m_allowSelf)
     normalizedB.append(other[0]->m_policy->getSelfSource());
-  for (size_t i = 1; i < other.size(); i++)
+
+  bool allowInlineOther = other[0]->m_allowInline;
+  bool allowDynamicOther = other[0]->m_allowDynamic;
+  bool isHashOrNoncePresentOther = other[0]->isHashOrNoncePresent();
+
+  for (size_t i = 1; i < other.size(); i++) {
+    allowInlineOther = allowInlineOther && other[i]->m_allowInline;
+    allowDynamicOther = allowDynamicOther && other[i]->m_allowDynamic;
+    isHashOrNoncePresentOther =
+        isHashOrNoncePresentOther && other[i]->isHashOrNoncePresent();
     normalizedB = other[i]->getIntersectCSPSources(normalizedB);
+  }
+
+  const ContentSecurityPolicy::DirectiveType type =
+      ContentSecurityPolicy::getDirectiveType(m_directiveName);
+  bool allowAllInlineOther =
+      allowInlineOther && !isHashOrNoncePresentOther &&
+      (type != ContentSecurityPolicy::DirectiveType::ScriptSrc ||
+       !allowDynamicOther);
+  if (!allowAllInline() && allowAllInlineOther)
+    return false;
 
   return CSPSource::firstSubsumesSecond(normalizedA, normalizedB);
 }
 
 HashMap<String, CSPSource*> SourceListDirective::getIntersectSchemesOnly(
     HeapVector<Member<CSPSource>> other) {
   HashMap<String, CSPSource*> schemesA;
   for (const auto& sourceA : m_list) {
     if (sourceA->isSchemeOnly())
       addSourceToMap(schemesA, sourceA);
@@ skipping 61 matching lines @@
   return normalized;
 }
 
 DEFINE_TRACE(SourceListDirective) {
   visitor->trace(m_policy);
   visitor->trace(m_list);
   CSPDirective::trace(visitor);
 }
 
 }  // namespace blink