Experiment with hiding <script>'s 'nonce' content attribute.

third_party/WebKit/Source/core/dom/ScriptLoader.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights
  * reserved.
  * Copyright (C) 2008 Nikolas Zimmermann <zimmermann@kde.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 329 matching lines @@
         ResourceRequest(elementDocument->completeURL(sourceUrl)),
         m_element->localName());
 
     CrossOriginAttributeValue crossOrigin = crossOriginAttributeValue(
         m_element->fastGetAttribute(HTMLNames::crossoriginAttr));
     if (crossOrigin != CrossOriginAttributeNotSet)
       request.setCrossOriginAccessControl(elementDocument->getSecurityOrigin(),
                                           crossOrigin);
     request.setCharset(scriptCharset());
 
-    if (ContentSecurityPolicy::isNonceableElement(m_element.get())) {
-      request.setContentSecurityPolicyNonce(
-          m_element->fastGetAttribute(HTMLNames::nonceAttr));
-    }
+    if (ContentSecurityPolicy::isNonceableElement(m_element.get()))
+      request.setContentSecurityPolicyNonce(client()->nonce());
 
     request.setParserDisposition(isParserInserted() ? ParserInserted
                                                     : NotParserInserted);
 
     request.setDefer(defer);
 
     String integrityAttr =
         m_element->fastGetAttribute(HTMLNames::integrityAttr);
     if (!integrityAttr.isEmpty()) {
       IntegrityMetadataSet metadataSet;
@@ skipping 94 matching lines @@
   LocalFrame* frame = contextDocument->frame();
 
   const ContentSecurityPolicy* csp = elementDocument->contentSecurityPolicy();
   bool shouldBypassMainWorldCSP =
       (frame && frame->script().shouldBypassMainWorldCSP()) ||
       csp->allowScriptWithHash(sourceCode.source(),
                                ContentSecurityPolicy::InlineType::Block);
 
   AtomicString nonce =
       ContentSecurityPolicy::isNonceableElement(m_element.get())
-          ? m_element->fastGetAttribute(HTMLNames::nonceAttr)
-          : AtomicString();
+          ? client()->nonce()
+          : nullAtom;
   if (!m_isExternalScript &&
       (!shouldBypassMainWorldCSP &&
        !csp->allowInlineScript(m_element, elementDocument->url(), nonce,
                                m_startLineNumber, sourceCode.source()))) {
     return false;
   }
 
   if (m_isExternalScript) {
     ScriptResource* resource =
         m_resource ? m_resource.get() : sourceCode.resource();
@@ skipping 65 matching lines @@
   // Create a script from the script element node, using the script
   // block's source and the script block's type.
   // Note: This is where the script is compiled and actually executed.
   frame->script().executeScriptInMainWorld(sourceCode, accessControlStatus);
 
   if (isHTMLScriptLoader(m_element) || isSVGScriptLoader(m_element)) {
     DCHECK(contextDocument->currentScript() == m_element);
     contextDocument->popCurrentScript();
   }
 
+  // "Number used _once_", so, clear it out after execution.
+  if (RuntimeEnabledFeatures::hideNonceContentAttributeEnabled())
+    client()->clearNonce();
+
   return true;
 }
 
 void ScriptLoader::execute() {
   DCHECK(!m_willBeParserExecuted);
   DCHECK(m_asyncExecType != ScriptRunner::None);
   DCHECK(m_pendingScript->resource());
   bool errorOccurred = false;
   ScriptSourceCode source = m_pendingScript->getSource(KURL(), errorOccurred);
   m_pendingScript->dispose();
@@ skipping 82 matching lines @@
   if (isHTMLScriptLoader(element))
     return toHTMLScriptElement(element)->loader();
 
   if (isSVGScriptLoader(element))
     return toSVGScriptElement(element)->loader();
 
   return 0;
 }
 
 }  // namespace blink