Part 3.3: Is policy list subsumed under subsuming policy?

third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPDirectiveList.h"
 
 #include "bindings/core/v8/SourceLocation.h"
 #include "core/dom/Document.h"
 #include "core/dom/SecurityContext.h"
 #include "core/dom/SpaceSplitString.h"
@@ skipping 145 matching lines @@
   }
   m_policy->reportViolation(directiveText, effectiveType, message, blockedURL,
                             m_reportEndpoints, m_header, m_headerType,
                             ContentSecurityPolicy::EvalViolation);
 }
 
 bool CSPDirectiveList::checkEval(SourceListDirective* directive) const {
   return !directive || directive->allowEval();
 }
 
 bool CSPDirectiveList::checkInline(SourceListDirective* directive) const {

[Mike West, 2016/11/29 12:00:50]

Can you just remove this method entirely, since it boils down to a single call
against the directive that you pass in?

-  return !directive ||
-         (directive->allowInline() && !directive->isHashOrNoncePresent());
+  return !directive || directive->allowAllInline();
 }
 
 bool CSPDirectiveList::isMatchingNoncePresent(SourceListDirective* directive,
                                               const String& nonce) const {
   return directive && directive->allowNonce(nonce);
 }
 
 bool CSPDirectiveList::checkHash(SourceListDirective* directive,
                                  const CSPHashValue& hashValue) const {
   return !directive || directive->allowHash(hashValue);
@@ skipping 203 matching lines @@
     const String& consoleMessage,
     Element* element,
     const String& contextURL,
     const WTF::OrdinalNumber& contextLine,
     bool isScript,
     const String& hashValue) const {
   if (checkInline(directive))
     return true;
 
   String suffix = String();
   if (directive->allowInline() && directive->isHashOrNoncePresent()) {

[amalika, 2016/11/29 09:42:29]

Left this as it is so that we display an appropriate message.

Otherwise, allowInline() gets called only by:
- this function
- and `checkInline` which I changed to use allowAllInline()

     // If inline is allowed, but a hash or nonce is present, we ignore
     // 'unsafe-inline'. Throw a reasonable error.
     suffix =
         " Note that 'unsafe-inline' is ignored if either a hash or nonce value "
         "is present in the source list.";
   } else {
     suffix =
         " Either the 'unsafe-inline' keyword, a hash ('" + hashValue +
         "'), or a nonce ('nonce-...') is required to enable inline execution.";
     if (directive == m_defaultSrc)
@@ skipping 872 matching lines @@
   visitor->trace(m_imgSrc);
   visitor->trace(m_mediaSrc);
   visitor->trace(m_manifestSrc);
   visitor->trace(m_objectSrc);
   visitor->trace(m_scriptSrc);
   visitor->trace(m_styleSrc);
   visitor->trace(m_workerSrc);
 }
 
 }  // namespace blink