CSP: Harden nonce parsing.

Source/core/frame/csp/CSPSourceList.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/frame/csp/CSPSourceList.h"
 
 #include "core/frame/csp/CSPSource.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "platform/ParsingUtilities.h"
@@ skipping 242 matching lines @@
     }
 
     return true;
 }
 
 // nonce-source      = "'nonce-" nonce-value "'"
 // nonce-value        = 1*( ALPHA / DIGIT / "+" / "/" / "=" )
 //
 bool CSPSourceList::parseNonce(const UChar* begin, const UChar* end, String& nonce)
 {
-    DEFINE_STATIC_LOCAL(const String, noncePrefix, ("'nonce-"));
+    size_t nonceLength = end - begin;
+    const char* prefix = "'nonce-";
 
-    if (!equalIgnoringCase(noncePrefix.characters8(), begin, noncePrefix.length()))
+    if (nonceLength <= strlen(prefix) || !equalIgnoringCase(prefix, begin, strlen(prefix)))
         return true;
 
-    const UChar* position = begin + noncePrefix.length();
+    const UChar* position = begin + strlen(prefix);
     const UChar* nonceBegin = position;
 
+    ASSERT(position < end);
     skipWhile<UChar, isNonceCharacter>(position, end);
     ASSERT(nonceBegin <= position);
 
-    if ((position + 1) != end || *position != '\'' || !(position - nonceBegin))
+    if (position + 1 != end || *position != '\'' || position == nonceBegin)
         return false;
 
     nonce = String(nonceBegin, position - nonceBegin);
     return true;
 }
 
 // hash-source       = "'" hash-algorithm "-" hash-value "'"
 // hash-algorithm    = "sha1" / "sha256" / "sha384" / "sha512"
 // hash-value        = 1*( ALPHA / DIGIT / "+" / "/" / "=" )
 //
@@ skipping 193 matching lines @@
 }
 
 void CSPSourceList::addSourceHash(const ContentSecurityPolicyHashAlgorithm& algorithm, const DigestValue& hash)
 {
     m_hashes.add(CSPHashValue(algorithm, hash));
     m_hashAlgorithmsUsed |= algorithm;
 }
 
 
 } // namespace blink