WIP: Give developers an opt-in mechanism to block some parser-inserted scripts.

third_party/WebKit/Source/core/frame/csp/SourceListDirective.cpp

Index: third_party/WebKit/Source/core/frame/csp/SourceListDirective.cpp
diff --git a/third_party/WebKit/Source/core/frame/csp/SourceListDirective.cpp b/third_party/WebKit/Source/core/frame/csp/SourceListDirective.cpp
index d9807bd0357fbda817ecb88b70ac7d9de3b5974d..4b15ad78932cdeb4371c2fb291612aef92408430 100644
--- a/third_party/WebKit/Source/core/frame/csp/SourceListDirective.cpp
+++ b/third_party/WebKit/Source/core/frame/csp/SourceListDirective.cpp
@@ -29,6 +29,7 @@ SourceListDirective::SourceListDirective(const String& name,
       m_allowEval(false),
       m_allowDynamic(false),
       m_allowHashedAttributes(false),
+      m_allowParserInsertedFromScript(true),
       m_hashAlgorithmsUsed(0) {
   Vector<UChar> characters;
   value.appendTo(characters);
@@ -103,10 +104,15 @@ bool SourceListDirective::allowHashedAttributes() const {
   return m_allowHashedAttributes;
 }
 
+bool SourceListDirective::allowParserInsertedFromScript() const {
+  return m_allowParserInsertedFromScript;
+}
+
 bool SourceListDirective::isNone() const {
   return !m_list.size() && !m_allowSelf && !m_allowStar && !m_allowInline &&
          !m_allowHashedAttributes && !m_allowEval && !m_allowDynamic &&
-         !m_nonces.size() && !m_hashes.size();
+         !m_nonces.size() && !m_hashes.size() &&
+         m_allowParserInsertedFromScript;
 }
 
 uint8_t SourceListDirective::hashAlgorithmsUsed() const {
@@ -211,6 +217,14 @@ bool SourceListDirective::parseSource(
     return true;
   }
 
+  // Naming is a work in progress... https://crbug.com/684435
+  if (equalIgnoringCase("'disallow-all-the-parser-inserted-scripts-ever-except-"
+                        "for-the-ones-we-like'",
+                        token)) {
+    m_allowParserInsertedFromScript = false;
+    return true;
+  }
+
   String nonce;
   if (!parseNonce(begin, end, nonce))
     return false;