More tweaks to <script nonce> hiding.

third_party/WebKit/Source/core/dom/ScriptLoader.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights
  * reserved.
  * Copyright (C) 2008 Nikolas Zimmermann <zimmermann@kde.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 501 matching lines @@
     // 21.6, "classic": "Fetch a classic script given ... CORS setting
     //                   ... and encoding."
     if (cross_origin != kCrossOriginAttributeNotSet)
       request.SetCrossOriginAccessControl(element_document->GetSecurityOrigin(),
                                           cross_origin);
 
     request.SetCharset(encoding);
 
     // 17. "If the script element has a nonce attribute,
     //      then let cryptographic nonce be that attribute's value.
     //      Otherwise, let cryptographic nonce be the empty string."

[kouhei (in TOK), 2017/04/11 12:24:18]

Would you update the spec text here to match:
https://github.com/whatwg/html/pull/2373/files#diff-36cd38f49b9afa08222c0dc9e...

-    if (element_->IsNonceableElement())
-      request.SetContentSecurityPolicyNonce(element_->nonce());
+    request.SetContentSecurityPolicyNonce(element_->GetNonceForElement());
 
     // 19. "Let parser state be "parser-inserted"
     //      if the script element has been flagged as "parser-inserted",
     //      and "not parser-inserted" otherwise."
     request.SetParserDisposition(IsParserInserted() ? kParserInserted
                                                     : kNotParserInserted);
 
     request.SetDefer(defer);
 
     // 18. "If the script element has an integrity attribute,
@@ skipping 124 matching lines @@
   if (!frame)
     return true;
 
   const ContentSecurityPolicy* csp =
       element_document->GetContentSecurityPolicy();
   bool should_bypass_main_world_csp =
       (frame->Script().ShouldBypassMainWorldCSP()) ||
       csp->AllowScriptWithHash(source_code.Source(),
                                ContentSecurityPolicy::InlineType::kBlock);
 
-  AtomicString nonce =
-      element_->IsNonceableElement() ? element_->nonce() : g_null_atom;
+  const AtomicString& nonce = element_->GetNonceForElement();
   if (!is_external_script_ && !should_bypass_main_world_csp &&
       !element_->AllowInlineScriptForCSP(nonce, start_line_number_,
                                          source_code.Source())) {
     return false;
   }
 
   if (is_external_script_) {
     ScriptResource* resource = source_code.GetResource();
     CHECK_EQ(resource, resource_);
     CHECK(resource);
@@ skipping 165 matching lines @@
   //     then abort these steps at this point. The script is not executed.
   return DeprecatedEqualIgnoringCase(event_attribute, "onload") ||
          DeprecatedEqualIgnoringCase(event_attribute, "onload()");
 }
 
 String ScriptLoader::ScriptContent() const {
   return element_->TextFromChildren();
 }
 
 }  // namespace blink