Experiment with hiding <script>'s 'nonce' content attribute.

third_party/WebKit/Source/core/html/HTMLScriptElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLScriptElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLScriptElement.cpp b/third_party/WebKit/Source/core/html/HTMLScriptElement.cpp
index 4bbe28de2e88c8453172bee74824b95aabb3af93..dcfb945fcb078e3133b0a0037c4bc6ddf29302c2 100644
--- a/third_party/WebKit/Source/core/html/HTMLScriptElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLScriptElement.cpp
@@ -33,6 +33,7 @@
 #include "core/dom/Text.h"
 #include "core/events/Event.h"
 #include "core/frame/UseCounter.h"
+#include "core/frame/csp/ContentSecurityPolicy.h"
 
 namespace blink {
 
@@ -86,6 +87,14 @@ void HTMLScriptElement::parseAttribute(
     logUpdateAttributeIfIsolatedWorldAndInDocument("script", params);
   } else if (params.name == asyncAttr) {
     m_loader->handleAsyncAttribute();
+  } else if (params.name == nonceAttr) {
+    if (params.newValue == ContentSecurityPolicy::getNonceReplacementString())
+      return;
+    m_nonce = params.newValue;
+    if (RuntimeEnabledFeatures::hideNonceContentAttributeEnabled()) {
+      setAttribute(nonceAttr,
+                   ContentSecurityPolicy::getNonceReplacementString());
+    }
   } else {
     HTMLElement::parseAttribute(params);
   }