Enable SRI only for same origin and CORS content.

Source/core/fetch/ResourceFetcher.cpp

 /*
     Copyright (C) 1998 Lars Knoll (knoll@mpi-hd.mpg.de)
     Copyright (C) 2001 Dirk Mueller (mueller@kde.org)
     Copyright (C) 2002 Waldo Bastian (bastian@kde.org)
     Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
     Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ skipping 584 matching lines @@
         // FIXME: Deal with RemoteFrames.
         if (frame()->tree().parent()->isLocalFrame())
             effectiveFrame = toLocalFrame(frame()->tree().parent());
     }
 
     MixedContentChecker::ReportingStatus mixedContentReporting = forPreload ?
         MixedContentChecker::SuppressReport : MixedContentChecker::SendReport;
     return !MixedContentChecker::shouldBlockFetch(effectiveFrame, resourceRequest, url, mixedContentReporting);
 }
 
-bool ResourceFetcher::canAccessResource(Resource* resource, SecurityOrigin* sourceOrigin, const KURL& url) const
+bool ResourceFetcher::canAccessResource(Resource* resource, SecurityOrigin* sourceOrigin, const KURL& url, bool logErrors) const

[Mike West, 2015/02/26 08:44:53]

I'd prefer to replace this boolean with an enum so that it's clear at the
callsites.

[jww, 2015/03/06 02:16:42]

Done.

 {
     // Redirects can change the response URL different from one of request.
     if (!canRequest(resource->type(), resource->resourceRequest(), url, resource->options(), resource->isUnusedPreload(), FetchRequest::UseDefaultOriginRestrictionForType))
         return false;
 
     if (!sourceOrigin && document())
         sourceOrigin = document()->securityOrigin();
 
     if (sourceOrigin->canRequest(url))
         return true;
 
     String errorDescription;
     if (!resource->passesAccessControlCheck(document(), sourceOrigin, errorDescription)) {
         if (resource->type() == Resource::Font)
             toFontResource(resource)->setCORSFailed();
-        if (frame() && frame()->document()) {
+        if (resource->type() == Resource::CSSStyleSheet)
+            toCSSStyleSheetResource(resource)->setCORSNeededAndFailed();

[Mike West, 2015/02/26 08:44:53]

It seems strange to set this as a side-effect of an access check. Perhaps you
could structure this as a property of Resource (e.g. pass in a SecurityOrigin,
and it tells you whether the algorithm in
https://w3c.github.io/webappsec/specs/subresourceintegrity/#is-resource-eligi...
returns true.

[jww, 2015/03/06 02:16:42]

Done.

+        if (frame() && frame()->document() && logErrors) {
             String resourceType = Resource::resourceTypeToString(resource->type(), resource->options().initiatorInfo);
             frame()->document()->addConsoleMessage(ConsoleMessage::create(JSMessageSource, ErrorMessageLevel, resourceType + " from origin '" + SecurityOrigin::create(url)->toString() + "' has been blocked from loading by Cross-Origin Resource Sharing policy: " + errorDescription));
         }
         return false;
     }
     return true;
 }
 
 bool ResourceFetcher::isControlledByServiceWorker() const
 {
@@ skipping 886 matching lines @@
         return false;
     if (options.corsEnabled == IsCORSEnabled) {
         SecurityOrigin* sourceOrigin = options.securityOrigin.get();
         if (!sourceOrigin && document())
             sourceOrigin = document()->securityOrigin();
 
         String errorMessage;
         if (!CrossOriginAccessControl::handleRedirect(document(), resource, sourceOrigin, request, redirectResponse, options, errorMessage)) {
             if (resource->type() == Resource::Font)
                 toFontResource(resource)->setCORSFailed();
+            if (resource->type() == Resource::CSSStyleSheet)
+                toCSSStyleSheetResource(resource)->setCORSNeededAndFailed();
             if (frame() && frame()->document())
                 frame()->document()->addConsoleMessage(ConsoleMessage::create(JSMessageSource, ErrorMessageLevel, errorMessage));
             return false;
         }
     }
     if (resource->type() == Resource::Image && shouldDeferImageLoad(request.url()))
         return false;
     return true;
 }
 
@@ skipping 114 matching lines @@
     ResourceLoaderHost::trace(visitor);
 }
 
 ResourceFetcher* ResourceFetcher::toResourceFetcher(ResourceLoaderHost* host)
 {
     ASSERT(host->objectType() == ResourceLoaderHost::ResourceFetcherType);
     return static_cast<ResourceFetcher*>(host);
 }
 
 }