Allow CSP checkNonce and checkHash to pass with 'unsafe-inline' only.

Allow CSP checkNonce and checkHash to pass with 'unsafe-inline' only.

There is a bug that a script will incorrectly not run when a nonce is
specified if 'unsafe-inline' is also specified in the policy and there's
a *second* policy that only specifies 'unsafe-inline'. This is due to a
cascading failure where the initial isAllowedByAllWithNonce check fails
because the second policy doesn't have a nonce, while the later
allowInlineScript check fails because the first policy's nonce
invalidates the 'unsafe-inline'.

This CL allows allowScriptNonce (and allowScriptHash) to pass if
'unsafe-inline' is present (and no hash or nonce is present). This also
adds tests to verify.

BUG=413482
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=181939

[jww, 2014-09-12 00:48:28]

jww@chromium.org changed reviewers:
+ mkwst@chromium.org

[Mike West, 2014-09-12 06:28:36]

Thanks for adding tests. LGTM.

[Mike West, 2014-09-12 06:28:39]

The CQ bit was checked by mkwst@chromium.org

[commit-bot: I haz the power, 2014-09-12 06:28:54]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patchset/568583003/20001

[commit-bot: I haz the power, 2014-09-12 08:29:13]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2014-09-12 08:29:14]

Exceeded time limit waiting for builds to trigger.

[Mike West, 2014-09-12 08:30:08]

The CQ bit was checked by mkwst@chromium.org

[commit-bot: I haz the power, 2014-09-12 08:31:00]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patchset/568583003/20001

[commit-bot: I haz the power, 2014-09-12 10:31:22]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2014-09-12 10:31:23]

Exceeded time limit waiting for builds to trigger.

[jww, 2014-09-12 20:34:46]

The CQ bit was checked by jww@chromium.org

[commit-bot: I haz the power, 2014-09-12 20:35:11]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patchset/568583003/60001

[commit-bot: I haz the power, 2014-09-12 22:09:36]

Committed patchset #4 (id:60001) as 181939

[Mike West, 2014-11-05 12:15:36]

On 2014/09/12 22:09:36, I haz the power (commit-bot) wrote:
> Committed patchset #4 (id:60001) as 181939

Reverting this in https://codereview.chromium.org/704723003/, as it turns out to
interact badly with the CSP-bypassing logic in ScriptLoader.