WIP: Give developers an opt-in mechanism to block some parser-inserted scripts.

third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp

Index: third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp
diff --git a/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp b/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp
index d3a63a2f37e0fb9940067aa4ac934e29f7825013..4c982d195aa4569e86cbc29c66275345adbcec9f 100644
--- a/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp
+++ b/third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp
@@ -182,6 +182,11 @@ bool CSPDirectiveList::checkDynamic(SourceListDirective* directive) const {
   return !directive || directive->allowDynamic();
 }
 
+bool CSPDirectiveList::checkParserInsertedFromScript(
+    SourceListDirective* directive) const {
+  return !directive || directive->allowParserInsertedFromScript();
+}
+
 void CSPDirectiveList::reportMixedContent(
     const KURL& mixedURL,
     ResourceRequest::RedirectStatus redirectStatus) const {
@@ -541,10 +546,19 @@ bool CSPDirectiveList::allowInlineScript(
   SourceListDirective* directive = operativeDirective(m_scriptSrc.get());
   if (isMatchingNoncePresent(directive, nonce))
     return true;
-  if (element && isHTMLScriptElement(element) &&
-      !toHTMLScriptElement(element)->loader()->isParserInserted() &&
-      allowDynamic()) {
-    return true;
+  if (element && isHTMLScriptElement(element)) {
+    HTMLScriptElement* script = toHTMLScriptElement(element);
+    if (script->loader()->isParserInserted()) {
+      if ((script->loader()->wasCreatedDuringDocumentWrite() ||
+           script->document().isDocumentWriteCreatedSrcdoc() ||
+           script->document().isFragmentParserCreatedSrcdoc()) &&
+          !allowParserInsertedFromScript()) {
+        // TODO(mkwst): Error reporting.
+        return false;
+      }
+    } else if (allowDynamic()) {
+      return true;
+    }
   }
   if (reportingStatus == ContentSecurityPolicy::SendReport) {
     return checkInlineAndReportViolation(
@@ -829,6 +843,12 @@ bool CSPDirectiveList::allowDynamic() const {
   return checkDynamic(operativeDirective(m_scriptSrc.get()));
 }
 
+bool CSPDirectiveList::allowParserInsertedFromScript() const {
+  if (!m_policy->experimentalFeaturesEnabled())
+    return true;
+  return checkParserInsertedFromScript(operativeDirective(m_scriptSrc.get()));
+}
+
 const String& CSPDirectiveList::pluginTypesText() const {
   ASSERT(hasPluginTypes());
   return m_pluginTypes->text();