Adjust the <script nonce>-hiding experiment

third_party/WebKit/Source/core/svg/SVGScriptElement.cpp

 /*
  * Copyright (C) 2004, 2005, 2008 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2004, 2005, 2007 Rob Buis <buis@kde.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Library General Public License for more details.
  *
  * You should have received a copy of the GNU Library General Public License
  * along with this library; see the file COPYING.LIB.  If not, write to
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
 
 #include "core/svg/SVGScriptElement.h"
 
 #include "bindings/core/v8/ScriptEventListener.h"
 #include "core/HTMLNames.h"
 #include "core/XLinkNames.h"
 #include "core/dom/Attribute.h"
 #include "core/dom/ScriptLoader.h"
 #include "core/dom/ScriptRunner.h"
 #include "core/events/Event.h"
+#include "core/frame/csp/ContentSecurityPolicy.h"
 
 namespace blink {
 
 inline SVGScriptElement::SVGScriptElement(Document& document,
                                           bool wasInsertedByParser,
                                           bool alreadyStarted)
     : SVGElement(SVGNames::scriptTag, document),
       SVGURIReference(this),
       m_loader(
-          ScriptLoader::create(this, wasInsertedByParser, alreadyStarted)) {
-  if (fastHasAttribute(HTMLNames::nonceAttr)) {
-    m_nonce = fastGetAttribute(HTMLNames::nonceAttr);
-    if (RuntimeEnabledFeatures::hideNonceContentAttributeEnabled())
-      removeAttribute(HTMLNames::nonceAttr);
-  }
-}
+          ScriptLoader::create(this, wasInsertedByParser, alreadyStarted)) {}
 
 SVGScriptElement* SVGScriptElement::create(Document& document,
                                            bool insertedByParser) {
   return new SVGScriptElement(document, insertedByParser, false);
 }
 
 void SVGScriptElement::parseAttribute(
     const AttributeModificationParams& params) {
   if (params.name == HTMLNames::onerrorAttr) {
     setAttributeEventListener(
         EventTypeNames::error,
         createAttributeEventListener(this, params.name, params.newValue,
                                      eventParameterName()));
+  } else if (params.name == HTMLNames::nonceAttr) {
+    if (params.newValue == ContentSecurityPolicy::getNonceReplacementString())
+      return;
+    setNonce(params.newValue);
+    if (RuntimeEnabledFeatures::hideNonceContentAttributeEnabled()) {
+      setAttribute(HTMLNames::nonceAttr,
+                   ContentSecurityPolicy::getNonceReplacementString());
+    }
   } else {
     SVGElement::parseAttribute(params);
   }
 }
 
 void SVGScriptElement::svgAttributeChanged(const QualifiedName& attrName) {
   if (SVGURIReference::isKnownAttribute(attrName)) {
     SVGElement::InvalidationGuard invalidationGuard(this);
     m_loader->handleSourceAttribute(hrefString());
     return;
@@ skipping 91 matching lines @@
 }
 #endif
 
 DEFINE_TRACE(SVGScriptElement) {
   visitor->trace(m_loader);
   SVGElement::trace(visitor);
   SVGURIReference::trace(visitor);
 }
 
 }  // namespace blink