Experiment with hiding <script>'s 'nonce' content attribute.

third_party/WebKit/Source/core/html/HTMLScriptElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights
  * reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 15 matching lines @@
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/ScriptEventListener.h"
 #include "core/HTMLNames.h"
 #include "core/dom/Attribute.h"
 #include "core/dom/Document.h"
 #include "core/dom/ScriptLoader.h"
 #include "core/dom/ScriptRunner.h"
 #include "core/dom/Text.h"
 #include "core/events/Event.h"
 #include "core/frame/UseCounter.h"
+#include "core/frame/csp/ContentSecurityPolicy.h"
 
 namespace blink {
 
 using namespace HTMLNames;
 
 inline HTMLScriptElement::HTMLScriptElement(Document& document,
                                             bool wasInsertedByParser,
                                             bool alreadyStarted,
                                             bool createdDuringDocumentWrite)
     : HTMLElement(scriptTag, document),
@@ skipping 33 matching lines @@
   HTMLElement::didMoveToNewDocument(oldDocument);
 }
 
 void HTMLScriptElement::parseAttribute(
     const AttributeModificationParams& params) {
   if (params.name == srcAttr) {
     m_loader->handleSourceAttribute(params.newValue);
     logUpdateAttributeIfIsolatedWorldAndInDocument("script", params);
   } else if (params.name == asyncAttr) {
     m_loader->handleAsyncAttribute();
+  } else if (params.name == nonceAttr) {
+    if (params.newValue == ContentSecurityPolicy::getNonceReplacementString())
+      return;
+    m_nonce = params.newValue;
+    if (RuntimeEnabledFeatures::hideNonceContentAttributeEnabled()) {
+      setAttribute(nonceAttr,
+                   ContentSecurityPolicy::getNonceReplacementString());
+    }
   } else {
     HTMLElement::parseAttribute(params);
   }
 }
 
 Node::InsertionNotificationRequest HTMLScriptElement::insertedInto(
     ContainerNode* insertionPoint) {
   if (insertionPoint->isConnected() && hasSourceAttribute() &&
       !loader()->isScriptTypeSupported(
           ScriptLoader::DisallowLegacyTypeInTypeAttribute))
@@ skipping 70 matching lines @@
   return new HTMLScriptElement(document(), false, m_loader->alreadyStarted(),
                                false);
 }
 
 DEFINE_TRACE(HTMLScriptElement) {
   visitor->trace(m_loader);
   HTMLElement::trace(visitor);
 }
 
 }  // namespace blink