More tweaks to <script nonce> hiding.

third_party/WebKit/Source/core/dom/ScriptLoader.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights
  * reserved.
  * Copyright (C) 2008 Nikolas Zimmermann <zimmermann@kde.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 322 matching lines @@
       credentials_mode = WebURLRequest::kFetchCredentialsModeSameOrigin;
       break;
     case kCrossOriginAttributeUseCredentials:
       credentials_mode = WebURLRequest::kFetchCredentialsModeInclude;
       break;
   }
 
   // 17. "If the script element has a nonce attribute,
   //      then let cryptographic nonce be that attribute's value.
   //      Otherwise, let cryptographic nonce be the empty string."
-  String nonce;
-  if (element_->IsNonceableElement())
-    nonce = element_->nonce();
+  String nonce = element_->GetNonceForElement();
 
   // 18. is handled below.
 
   // 19. "Let parser state be "parser-inserted"
   //      if the script element has been flagged as "parser-inserted",
   //      and "not parser-inserted" otherwise."
   ParserDisposition parser_state =
       IsParserInserted() ? kParserInserted : kNotParserInserted;
 
   // 21. "If the element has a src content attribute, run these substeps:"
@@ skipping 465 matching lines @@
     return true;
 
   if (!is_external_script_) {
     const ContentSecurityPolicy* csp =
         element_document->GetContentSecurityPolicy();
     bool should_bypass_main_world_csp =
         (frame->GetScriptController().ShouldBypassMainWorldCSP()) ||
         csp->AllowScriptWithHash(script->InlineSourceTextForCSP(),
                                  ContentSecurityPolicy::InlineType::kBlock);
 
-    AtomicString nonce =
-        element_->IsNonceableElement() ? element_->nonce() : g_null_atom;
+    AtomicString nonce = element_->GetNonceForElement();
     if (!should_bypass_main_world_csp &&
         !element_->AllowInlineScriptForCSP(nonce, start_line_number_,
                                            script->InlineSourceTextForCSP())) {
       return false;
     }
   }
 
   if (is_external_script_) {
     if (!script->CheckMIMETypeBeforeRunScript(
             context_document, element_->GetDocument().GetSecurityOrigin()))
@@ skipping 137 matching lines @@
   //     then abort these steps at this point. The script is not executed.
   return DeprecatedEqualIgnoringCase(event_attribute, "onload") ||
          DeprecatedEqualIgnoringCase(event_attribute, "onload()");
 }
 
 String ScriptLoader::ScriptContent() const {
   return element_->TextFromChildren();
 }
 
 }  // namespace blink