Part 3.6: Is policy list subsumed under subsuming policy?

third_party/WebKit/Source/core/frame/csp/SourceListDirective.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/SourceListDirective.h"
 
 #include "core/frame/csp/CSPSource.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "platform/network/ContentSecurityPolicyParsers.h"
 #include "platform/weborigin/KURL.h"
@@ skipping 600 matching lines @@
 
   HeapVector<Member<CSPSource>> normalizedB = other[0]->m_list;
   if (other[0]->m_allowSelf && other[0]->m_policy->getSelfSource())
     normalizedB.append(other[0]->m_policy->getSelfSource());
 
   bool allowInlineOther = other[0]->m_allowInline;
   bool allowEvalOther = other[0]->m_allowEval;
   bool allowDynamicOther = other[0]->m_allowDynamic;
   bool allowHashedAttributesOther = other[0]->m_allowHashedAttributes;
   bool isHashOrNoncePresentOther = other[0]->isHashOrNoncePresent();
+  HashSet<String> noncesB = other[0]->m_nonces;
+  HashSet<CSPHashValue> hashesB = other[0]->m_hashes;
 
   for (size_t i = 1; i < other.size(); i++) {
     allowInlineOther = allowInlineOther && other[i]->m_allowInline;
     allowEvalOther = allowEvalOther && other[i]->m_allowEval;
     allowDynamicOther = allowDynamicOther && other[i]->m_allowDynamic;
     allowHashedAttributesOther =
         allowHashedAttributesOther && other[i]->m_allowHashedAttributes;
     isHashOrNoncePresentOther =
         isHashOrNoncePresentOther && other[i]->isHashOrNoncePresent();
+    noncesB = other[i]->getIntersectNonces(noncesB);
+    hashesB = other[i]->getIntersectHashes(hashesB);
     normalizedB = other[i]->getIntersectCSPSources(normalizedB);
   }
 
+  if (!subsumesNoncesAndHashes(noncesB, hashesB))
+    return false;
+
   const ContentSecurityPolicy::DirectiveType type =
       ContentSecurityPolicy::getDirectiveType(m_directiveName);
   if (type == ContentSecurityPolicy::DirectiveType::ScriptSrc ||
       type == ContentSecurityPolicy::DirectiveType::StyleSrc) {
     if (!m_allowEval && allowEvalOther)
       return false;
     if (!m_allowHashedAttributes && allowHashedAttributesOther)
       return false;
     bool allowAllInlineOther =
         allowInlineOther && !isHashOrNoncePresentOther &&
         (type != ContentSecurityPolicy::DirectiveType::ScriptSrc ||
          !allowDynamicOther);
     if (!allowAllInline() && allowAllInlineOther)
       return false;
   }
 
   return CSPSource::firstSubsumesSecond(normalizedA, normalizedB);
 }
 
+bool SourceListDirective::subsumesNoncesAndHashes(
+    const HashSet<String>& nonces,
+    const HashSet<CSPHashValue> hashes) const {
+  for (const auto& nonce : nonces) {
+    if (!m_nonces.contains(nonce))
+      return false;
+  }
+  for (const auto& hash : hashes) {
+    if (!m_hashes.contains(hash))
+      return false;
+  }
+
+  return true;
+}
+
+HashSet<String> SourceListDirective::getIntersectNonces(
+    const HashSet<String>& other) const {
+  if (!m_nonces.size() || !other.size())
+    return !m_nonces.size() ? m_nonces : other;
+
+  HashSet<String> normalized;
+  for (const auto& nonce : m_nonces) {
+    if (other.contains(nonce))
+      normalized.add(nonce);
+  }
+
+  return normalized;
+}
+
+HashSet<CSPHashValue> SourceListDirective::getIntersectHashes(
+    const HashSet<CSPHashValue>& other) const {
+  if (!m_hashes.size() || !other.size())
+    return !m_hashes.size() ? m_hashes : other;
+
+  HashSet<CSPHashValue> normalized;
+  for (const auto& hash : m_hashes) {
+    if (other.contains(hash))
+      normalized.add(hash);
+  }
+
+  return normalized;
+}
+
 HeapHashMap<String, Member<CSPSource>>
 SourceListDirective::getIntersectSchemesOnly(
     const HeapVector<Member<CSPSource>>& other) const {
   HeapHashMap<String, Member<CSPSource>> schemesA;
   for (const auto& sourceA : m_list) {
     if (sourceA->isSchemeOnly())
       addSourceToMap(schemesA, sourceA);
   }
   // Add schemes only sources if they are present in both `this` and `other`,
   // allowing upgrading `http` to `https` and `ws` to `wss`.
@@ skipping 58 matching lines @@
   return normalized;
 }
 
 DEFINE_TRACE(SourceListDirective) {
   visitor->trace(m_policy);
   visitor->trace(m_list);
   CSPDirective::trace(visitor);
 }
 
 }  // namespace blink