CSP: Enable whitelisting of external JavaScript via hashes

third_party/WebKit/Source/core/workers/WorkerGlobalScope.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  * Copyright (C) 2009, 2011 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 164 matching lines @@
   ExecutionContext& executionContext = *this->getExecutionContext();
 
   Vector<KURL> completedURLs;
   for (const String& urlString : urls) {
     const KURL& url = executionContext.completeURL(urlString);
     if (!url.isValid()) {
       exceptionState.throwDOMException(
           SyntaxError, "The URL '" + urlString + "' is invalid.");
       return;
     }
-    if (!contentSecurityPolicy()->allowScriptFromSource(url, AtomicString(),
-                                                        NotParserInserted)) {
+    if (!contentSecurityPolicy()->allowScriptFromSource(
+            url, AtomicString(), IntegrityMetadataSet(), NotParserInserted)) {
       exceptionState.throwDOMException(
           NetworkError,
           "The script at '" + url.elidedString() + "' failed to load.");
       return;
     }
     completedURLs.push_back(url);
   }
 
   for (const KURL& completeURL : completedURLs) {
     RefPtr<WorkerScriptLoader> scriptLoader(WorkerScriptLoader::create());
@@ skipping 175 matching lines @@
   visitor->trace(m_timers);
   visitor->trace(m_eventListeners);
   visitor->trace(m_pendingErrorEvents);
   ExecutionContext::trace(visitor);
   EventTargetWithInlineData::trace(visitor);
   SecurityContext::trace(visitor);
   Supplementable<WorkerGlobalScope>::trace(visitor);
 }
 
 }  // namespace blink