Part 3.4: Is policy list subsumed under subsuming policy?

third_party/WebKit/Source/core/frame/csp/SourceListDirective.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/SourceListDirective.h"
 
 #include "core/frame/csp/CSPSource.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "platform/network/ContentSecurityPolicyParsers.h"
 #include "platform/weborigin/KURL.h"
@@ skipping 589 matching lines @@
 
   HeapVector<Member<CSPSource>> normalizedA = m_list;
   if (m_allowSelf)
     normalizedA.append(m_policy->getSelfSource());
 
   HeapVector<Member<CSPSource>> normalizedB = other[0]->m_list;
   if (other[0]->m_allowSelf)
     normalizedB.append(other[0]->m_policy->getSelfSource());
 
   bool allowInlineOther = other[0]->m_allowInline;
+  bool allowEvalOther = other[0]->m_allowEval;
   bool allowDynamicOther = other[0]->m_allowDynamic;
+  bool allowHashedAttributesOther = other[0]->m_allowHashedAttributes;
   bool isHashOrNoncePresentOther = other[0]->isHashOrNoncePresent();
 
   for (size_t i = 1; i < other.size(); i++) {
     allowInlineOther = allowInlineOther && other[i]->m_allowInline;
+    allowEvalOther = allowEvalOther && other[i]->m_allowEval;
     allowDynamicOther = allowDynamicOther && other[i]->m_allowDynamic;
+    allowHashedAttributesOther =
+        allowHashedAttributesOther && other[i]->m_allowHashedAttributes;
     isHashOrNoncePresentOther =
         isHashOrNoncePresentOther && other[i]->isHashOrNoncePresent();
     normalizedB = other[i]->getIntersectCSPSources(normalizedB);
   }
 
   const ContentSecurityPolicy::DirectiveType type =
       ContentSecurityPolicy::getDirectiveType(m_directiveName);
-  bool allowAllInlineOther =
-      allowInlineOther && !isHashOrNoncePresentOther &&
-      (type != ContentSecurityPolicy::DirectiveType::ScriptSrc ||
-       !allowDynamicOther);
-  if (!allowAllInline() && allowAllInlineOther)
-    return false;
+  if (type == ContentSecurityPolicy::DirectiveType::ScriptSrc ||
+      type == ContentSecurityPolicy::DirectiveType::StyleSrc) {
+    if (type == ContentSecurityPolicy::DirectiveType::ScriptSrc &&

[Mike West, 2016/11/29 12:05:48]

Default? Or is |type| the effective directive here?

[amalika, 2016/11/29 13:37:45]

Yes! It is only the operative directive. On CSPDirctiveList level we never check
DefaultSrc.

+        !m_allowDynamic && !allowAllInline() && allowDynamicOther) {
+      return false;
+    }
+    if (!m_allowEval && allowEvalOther)
+      return false;
+    if (!m_allowHashedAttributes && allowHashedAttributesOther)
+      return false;
+    bool allowAllInlineOther =
+        allowInlineOther && !isHashOrNoncePresentOther &&
+        (type != ContentSecurityPolicy::DirectiveType::ScriptSrc ||
+         !allowDynamicOther);
+    if (!allowAllInline() && allowAllInlineOther)
+      return false;
+  }
 
   return CSPSource::firstSubsumesSecond(normalizedA, normalizedB);
 }
 
 HashMap<String, CSPSource*> SourceListDirective::getIntersectSchemesOnly(
     HeapVector<Member<CSPSource>> other) {
   HashMap<String, CSPSource*> schemesA;
   for (const auto& sourceA : m_list) {
     if (sourceA->isSchemeOnly())
       addSourceToMap(schemesA, sourceA);
@@ skipping 61 matching lines @@
   return normalized;
 }
 
 DEFINE_TRACE(SourceListDirective) {
   visitor->trace(m_policy);
   visitor->trace(m_list);
   CSPDirective::trace(visitor);
 }
 
 }  // namespace blink