Implement script MIME restrictions for X-Content-Type-Options: nosniff for Workers

third_party/WebKit/Source/core/dom/ScriptLoader.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights
  * reserved.
  * Copyright (C) 2008 Nikolas Zimmermann <zimmermann@kde.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 462 matching lines @@
       (!shouldBypassMainWorldCSP &&
        !csp->allowInlineScript(m_element, elementDocument->url(), nonce,
                                m_startLineNumber, sourceCode.source()))) {
     return false;
   }
 
   if (m_isExternalScript) {
     ScriptResource* resource =
         m_resource ? m_resource.get() : sourceCode.resource();
     if (resource) {
-      if (!resource->mimeTypeAllowedByNosniff()) {
+      if (!ScriptResource::mimeTypeAllowedByNosniff(resource->response())) {
         contextDocument->addConsoleMessage(ConsoleMessage::create(
             SecurityMessageSource, ErrorMessageLevel,
             "Refused to execute script from '" +
                 resource->url().elidedString() + "' because its MIME type ('" +
                 resource->httpContentType() + "') is not executable, and "
                                               "strict MIME type checking is "
                                               "enabled."));
         return false;
       }
 
@@ skipping 150 matching lines @@
   if (isHTMLScriptLoader(element))
     return toHTMLScriptElement(element)->loader();
 
   if (isSVGScriptLoader(element))
     return toSVGScriptElement(element)->loader();
 
   return 0;
 }
 
 }  // namespace blink