Index: Source/core/dom/ScriptLoader.cpp |
diff --git a/Source/core/dom/ScriptLoader.cpp b/Source/core/dom/ScriptLoader.cpp |
index f69e0e63d362e4750b5f16bbce060813de6b7058..9805ea52efdfb846f729ddfe9c7687d1b834b5f3 100644 |
--- a/Source/core/dom/ScriptLoader.cpp |
+++ b/Source/core/dom/ScriptLoader.cpp |
@@ -42,6 +42,7 @@ |
#include "core/html/imports/HTMLImport.h" |
#include "core/html/parser/HTMLParserIdioms.h" |
#include "core/frame/LocalFrame.h" |
+#include "core/frame/SubresourceIntegrity.h" |
#include "core/frame/csp/ContentSecurityPolicy.h" |
#include "core/inspector/ConsoleMessage.h" |
#include "core/svg/SVGScriptElement.h" |
@@ -318,6 +319,10 @@ void ScriptLoader::executeScript(const ScriptSourceCode& sourceCode) |
contextDocument->addConsoleMessage(ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel, "Refused to execute script from '" + resource->url().elidedString() + "' because its MIME type ('" + resource->mimeType() + "') is not executable, and strict MIME type checking is enabled.")); |
return; |
} |
+ |
+ // TODO(jww): On failure, SRI should probably provide an error message for the console. |
Mike West
2014/09/16 06:45:03
nit: Blink style is '// FIXME:'. Rather than taggi
jww
2014/09/16 22:34:49
Done.
|
+ if (!SubresourceIntegrity::CheckSubresourceIntegrity(*m_element, sourceCode.source(), sourceCode.resource()->url())) |
Mike West
2014/09/16 06:45:03
Perhaps this could be simplified by just passing i
jww
2014/09/16 22:34:49
My thought is that we're going to do this for Styl
|
+ return; |
} |
// FIXME: Can this be moved earlier in the function? |