Implementation of subresource integrity attribute for style sheets.

Implementation of subresource integrity attribute for style sheets.

This is an implementation of subresource integrity for style sheets set
on link elements. This CL adds a check to style sheet loads to make sure
that the digest of the style sheet content matches an integrity
attribute, if there is one. Similar to the script implementation, it is
only valid for secure origins to secure resources.

See http://www.w3.org/TR/SRI/ for the W3C standard proposal.

Intent to implement discussion:
https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/hTDUpMk_TV8

BUG=355467
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=183365

[jww, 2014-10-02 18:05:40]

jww@chromium.org changed reviewers:
+ mkwst@chromium.org

[jww, 2014-10-02 18:06:10]

Mike, can you take a look at this CL for adding SRI to style sheets?

[Mike West, 2014-10-02 18:52:45]

This looks great; it's nice to see how easy it is to add new elements now that
you've done the grunt work for scripts. :)

Code change LGTM, tests need a bit of work. They should use testharness.js (both
because that's the direction layout tests are going, and because we'll be more
easily able to reuse them for a W3C test suite). If you convert over to that
framework and use it's asserts, I'd be happy to see you land this.

https://codereview.chromium.org/622783004/diff/1/LayoutTests/http/tests/secur...
File
LayoutTests/http/tests/security/subresourceIntegrity/subresource-integrity-style-blocked.html
(right):

https://codereview.chromium.org/622783004/diff/1/LayoutTests/http/tests/secur...
LayoutTests/http/tests/security/subresourceIntegrity/subresource-integrity-style-blocked.html:18:
if (color === "rgb(0, 128, 0)")
Please convert these to testharness.js tests, and use assert_equals here rather
than building your own pass and fail messages.

[Mike West, 2014-10-02 18:53:32]

This looks great; it's nice to see how easy it is to add new elements now that
you've done the grunt work for scripts. :)

Code change LGTM, tests need a bit of work. They should use testharness.js (both
because that's the direction layout tests are going, and because we'll be more
easily able to reuse them for a W3C test suite). If you convert over to that
framework and use it's asserts, I'd be happy to see you land this.

[adamk, 2014-10-02 19:15:19]

adamk@chromium.org changed reviewers:
+ morrita@chromium.org

[adamk, 2014-10-02 19:15:20]

I'd like someone who knows <link> tags well to take a look at this, nominating
morrita@.

[jww, 2014-10-02 22:12:18]

Thanks, Mike. Tests updated.

morrita@, looking forward to your review to see if I did anything too crazy in
HTMLLinkElement.cpp :-)

https://codereview.chromium.org/622783004/diff/1/LayoutTests/http/tests/secur...
File
LayoutTests/http/tests/security/subresourceIntegrity/subresource-integrity-style-blocked.html
(right):

https://codereview.chromium.org/622783004/diff/1/LayoutTests/http/tests/secur...
LayoutTests/http/tests/security/subresourceIntegrity/subresource-integrity-style-blocked.html:18:
if (color === "rgb(0, 128, 0)")
On 2014/10/02 18:52:44, Mike West (OOO until 6th) wrote:
> Please convert these to testharness.js tests, and use assert_equals here
rather
> than building your own pass and fail messages.

Done.

[Hajime Morrita, 2014-10-07 01:32:48]

Sorry for overlooking this. core/ lgtm.

[jww, 2014-10-07 05:23:10]

On 2014/10/07 01:32:48, morrita wrote:
> Sorry for overlooking this. core/ lgtm.

No worries, thanks!

[jww, 2014-10-07 05:23:22]

The CQ bit was checked by jww@chromium.org

[commit-bot: I haz the power, 2014-10-07 05:24:32]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/622783004/40001

[commit-bot: I haz the power, 2014-10-07 06:24:21]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2014-10-07 06:24:24]

Try jobs failed on following builders:
  linux_blink_rel on tryserver.blink
(http://build.chromium.org/p/tryserver.blink/builders/linux_blink_rel/builds/2...)

[jww, 2014-10-07 18:57:02]

The CQ bit was checked by jww@chromium.org

[commit-bot: I haz the power, 2014-10-07 18:57:56]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/622783004/60001

[commit-bot: I haz the power, 2014-10-07 23:13:26]

Committed patchset #4 (id:60001) as 183365