WIP: Give developers an opt-in mechanism to block some parser-inserted scripts.

third_party/WebKit/Source/core/frame/csp/SourceListDirectiveTest.cpp

Index: third_party/WebKit/Source/core/frame/csp/SourceListDirectiveTest.cpp
diff --git a/third_party/WebKit/Source/core/frame/csp/SourceListDirectiveTest.cpp b/third_party/WebKit/Source/core/frame/csp/SourceListDirectiveTest.cpp
index a2e10a38b846664ddcaaaf7bb2b28cc0de2ae483..891bfdde62afdd530dd13a2d6f9b547998f68457 100644
--- a/third_party/WebKit/Source/core/frame/csp/SourceListDirectiveTest.cpp
+++ b/third_party/WebKit/Source/core/frame/csp/SourceListDirectiveTest.cpp
@@ -80,6 +80,22 @@ TEST_F(SourceListDirectiveTest, BasicMatchingUnsafeHashedAttributes) {
   EXPECT_TRUE(sourceList.allowHashedAttributes());
 }
 
+TEST_F(SourceListDirectiveTest, BasicMatchingParserInserted) {
+  {
+    String sources = "https://example.com 'strict-dynamic'";
+    SourceListDirective sourceList("script-src", sources, csp.get());
+    EXPECT_TRUE(sourceList.allowParserInsertedFromScript());
+  }
+
+  {
+    String sources =
+        "'disallow-all-the-parser-inserted-scripts-ever-except-for-the-ones-we-"
+        "like'";
+    SourceListDirective sourceList("script-src", sources, csp.get());
+    EXPECT_FALSE(sourceList.allowParserInsertedFromScript());
+  }
+}
+
 TEST_F(SourceListDirectiveTest, BasicMatchingStar) {
   KURL base;
   String sources = "*";