Implementation of script hashes for CSP.

Source/core/dom/ScriptLoader.cpp

Index: Source/core/dom/ScriptLoader.cpp
diff --git a/Source/core/dom/ScriptLoader.cpp b/Source/core/dom/ScriptLoader.cpp
index cfefea53954aafc27b1b0424aef16358fdbecc4d..8b5539f3740165843d91afc37bffe3145a9d4fcc 100644
--- a/Source/core/dom/ScriptLoader.cpp
+++ b/Source/core/dom/ScriptLoader.cpp
@@ -308,7 +308,11 @@ void ScriptLoader::executeScript(const ScriptSourceCode& sourceCode)
 
     Frame* frame = contextDocument->frame();
 
-    bool shouldBypassMainWorldContentSecurityPolicy = (frame && frame->script()->shouldBypassMainWorldContentSecurityPolicy()) || elementDocument->contentSecurityPolicy()->allowScriptNonce(m_element->fastGetAttribute(HTMLNames::nonceAttr));
+    bool frameContentSecurityPolicyBypass = frame && frame->script()->shouldBypassMainWorldContentSecurityPolicy();
+    bool allowScriptNonce = elementDocument->contentSecurityPolicy()->allowScriptNonce(m_element->fastGetAttribute(HTMLNames::nonceAttr));
+    bool allowScriptHash = elementDocument->contentSecurityPolicy()->allowScriptHash(sourceCode.source());
+
+    bool shouldBypassMainWorldContentSecurityPolicy = frameContentSecurityPolicyBypass || allowScriptNonce || allowScriptHash;

[abarth-chromium, 2013/10/22 17:46:49]

This has the same problem of eagerly evaluating all these "allow" calls.  Given
that they can have side effects (like sending violation reports), we don't want
to evaluate them eagerly.  Instead, we want to do them in a specific order and
bail out when we've gotten an answer.

[jww, 2013/10/28 19:36:23]

Done.

 
     if (!m_isExternalScript && (!shouldBypassMainWorldContentSecurityPolicy && !elementDocument->contentSecurityPolicy()->allowInlineScript(elementDocument->url(), m_startLineNumber)))
         return;