CSP: Enable whitelisting of external JavaScript via hashes

third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp

 /*
  * Copyright (C) 2011 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 477 matching lines @@
   for (const auto& policy : policies) {
     isAllowed &= (policy.get()->*allowFromURLWithNonce)(
         url, nonce, redirectStatus, reportingPolicy);
   }
   return isAllowed;
 }
 
 template <bool (CSPDirectiveList::*allowFromURLWithNonceAndParser)(
     const KURL&,
     const String& nonce,
+    const IntegrityMetadataSet& hashes,
     ParserDisposition parserDisposition,
     RedirectStatus,
     SecurityViolationReportingPolicy) const>
 bool isAllowedByAll(const CSPDirectiveListVector& policies,
                     const KURL& url,
                     const String& nonce,
+                    const IntegrityMetadataSet& hashes,
                     ParserDisposition parserDisposition,
                     RedirectStatus redirectStatus,
                     SecurityViolationReportingPolicy reportingPolicy) {
   if (ContentSecurityPolicy::shouldBypassContentSecurityPolicy(url)) {
     // If we're running experimental features, bypass CSP only for
     // non-parser-inserted resources whose scheme otherwise bypasses CSP. If
     // we're not running experimental features, bypass CSP for all resources
     // regardless of parser state. Once we have more data via the
     // 'ScriptWithCSPBypassingScheme*' metrics, make a decision about what
     // behavior to ship. https://crbug.com/653521
     if (parserDisposition == NotParserInserted ||
         !RuntimeEnabledFeatures::
             experimentalContentSecurityPolicyFeaturesEnabled()) {
       return true;
     }
   }
 
   bool isAllowed = true;
   for (const auto& policy : policies) {
     isAllowed &= (policy.get()->*allowFromURLWithNonceAndParser)(
-        url, nonce, parserDisposition, redirectStatus, reportingPolicy);
+        url, nonce, hashes, parserDisposition, redirectStatus, reportingPolicy);
   }
   return isAllowed;
 }
 
 template <bool (CSPDirectiveList::*allowed)(LocalFrame*,
                                             const KURL&,
                                             SecurityViolationReportingPolicy)
               const>
 bool isAllowedByAll(const CSPDirectiveListVector& policies,
                     LocalFrame* frame,
@@ skipping 156 matching lines @@
     if (parentCSP && !parentCSP->allowPluginType(type, typeAttribute, url))
       return false;
   }
 
   return true;
 }
 
 bool ContentSecurityPolicy::allowScriptFromSource(
     const KURL& url,
     const String& nonce,
+    const IntegrityMetadataSet& hashes,
     ParserDisposition parserDisposition,
     RedirectStatus redirectStatus,
     SecurityViolationReportingPolicy reportingPolicy) const {
   if (shouldBypassContentSecurityPolicy(url)) {
     UseCounter::count(
         document(),
         parserDisposition == ParserInserted
             ? UseCounter::ScriptWithCSPBypassingSchemeParserInserted
             : UseCounter::ScriptWithCSPBypassingSchemeNotParserInserted);
   }
   return isAllowedByAll<&CSPDirectiveList::allowScriptFromSource>(
-      m_policies, url, nonce, parserDisposition, redirectStatus,
+      m_policies, url, nonce, hashes, parserDisposition, redirectStatus,
       reportingPolicy);
 }
 
 bool ContentSecurityPolicy::allowScriptWithHash(const String& source,
                                                 InlineType type) const {
   return checkDigest<&CSPDirectiveList::allowScriptHash>(
       source, type, m_scriptHashAlgorithmsUsed, m_policies);
 }
 
 bool ContentSecurityPolicy::allowStyleWithHash(const String& source,
@@ skipping 49 matching lines @@
     case WebURLRequest::RequestContextFont:
       return allowFontFromSource(url, redirectStatus, reportingPolicy);
     case WebURLRequest::RequestContextForm:
       return allowFormAction(url, redirectStatus, reportingPolicy);
     case WebURLRequest::RequestContextFrame:
     case WebURLRequest::RequestContextIframe:
       return allowFrameFromSource(url, redirectStatus, reportingPolicy);
     case WebURLRequest::RequestContextImport:
     case WebURLRequest::RequestContextScript:
     case WebURLRequest::RequestContextXSLT:
-      return allowScriptFromSource(url, nonce, parserDisposition,
-                                   redirectStatus, reportingPolicy);
+      return allowScriptFromSource(url, nonce, integrityMetadata,
+                                   parserDisposition, redirectStatus,
+                                   reportingPolicy);
     case WebURLRequest::RequestContextManifest:
       return allowManifestFromSource(url, redirectStatus, reportingPolicy);
     case WebURLRequest::RequestContextServiceWorker:
     case WebURLRequest::RequestContextSharedWorker:
     case WebURLRequest::RequestContextWorker:
       return allowWorkerContextFromSource(url, redirectStatus, reportingPolicy);
     case WebURLRequest::RequestContextStyle:
       return allowStyleFromSource(url, nonce, redirectStatus, reportingPolicy);
     case WebURLRequest::RequestContextCSPReport:
     case WebURLRequest::RequestContextDownload:
@@ skipping 100 matching lines @@
     RedirectStatus redirectStatus,
     SecurityViolationReportingPolicy reportingPolicy) const {
   // CSP 1.1 moves workers from 'script-src' to the new 'child-src'. Measure the
   // impact of this backwards-incompatible change.
   if (Document* document = this->document()) {
     UseCounter::count(*document, UseCounter::WorkerSubjectToCSP);
     if (isAllowedByAll<&CSPDirectiveList::allowWorkerFromSource>(
             m_policies, url, redirectStatus,
             SecurityViolationReportingPolicy::SuppressReporting) &&
         !isAllowedByAll<&CSPDirectiveList::allowScriptFromSource>(
-            m_policies, url, AtomicString(), NotParserInserted, redirectStatus,
+            m_policies, url, AtomicString(), IntegrityMetadataSet(),
+            NotParserInserted, redirectStatus,
             SecurityViolationReportingPolicy::SuppressReporting)) {
       UseCounter::count(*document,
                         UseCounter::WorkerAllowedByChildBlockedByScript);
     }
   }
 
   return isAllowedByAll<&CSPDirectiveList::allowWorkerFromSource>(
       m_policies, url, redirectStatus, reportingPolicy);
 }
 
@@ skipping 696 matching lines @@
   if (SecurityOrigin::shouldUseInnerURL(url)) {
     return SchemeRegistry::schemeShouldBypassContentSecurityPolicy(
         SecurityOrigin::extractInnerURL(url).protocol(), area);
   } else {
     return SchemeRegistry::schemeShouldBypassContentSecurityPolicy(
         url.protocol(), area);
   }
 }
 
 }  // namespace blink