Enable SRI only for same origin and CORS content.

Source/core/fetch/ResourceFetcher.cpp

Index: Source/core/fetch/ResourceFetcher.cpp
diff --git a/Source/core/fetch/ResourceFetcher.cpp b/Source/core/fetch/ResourceFetcher.cpp
index 97f4708fcefe8d0b7f42ec42487333e639b23beb..235c291b21124dbe4d657ef9a48731e6654b2fe1 100644
--- a/Source/core/fetch/ResourceFetcher.cpp
+++ b/Source/core/fetch/ResourceFetcher.cpp
@@ -602,7 +602,7 @@ bool ResourceFetcher::canRequest(Resource::Type type, const ResourceRequest& res
     return !MixedContentChecker::shouldBlockFetch(effectiveFrame, resourceRequest, url, mixedContentReporting);
 }
 
-bool ResourceFetcher::canAccessResource(Resource* resource, SecurityOrigin* sourceOrigin, const KURL& url) const
+bool ResourceFetcher::canAccessResource(Resource* resource, SecurityOrigin* sourceOrigin, const KURL& url, bool logErrors) const

[Mike West, 2015/02/26 08:44:53]

I'd prefer to replace this boolean with an enum so that it's clear at the
callsites.

[jww, 2015/03/06 02:16:42]

Done.

 {
     // Redirects can change the response URL different from one of request.
     if (!canRequest(resource->type(), resource->resourceRequest(), url, resource->options(), resource->isUnusedPreload(), FetchRequest::UseDefaultOriginRestrictionForType))
@@ -618,7 +618,9 @@ bool ResourceFetcher::canAccessResource(Resource* resource, SecurityOrigin* sour
     if (!resource->passesAccessControlCheck(document(), sourceOrigin, errorDescription)) {
         if (resource->type() == Resource::Font)
             toFontResource(resource)->setCORSFailed();
-        if (frame() && frame()->document()) {
+        if (resource->type() == Resource::CSSStyleSheet)
+            toCSSStyleSheetResource(resource)->setCORSNeededAndFailed();

[Mike West, 2015/02/26 08:44:53]

It seems strange to set this as a side-effect of an access check. Perhaps you
could structure this as a property of Resource (e.g. pass in a SecurityOrigin,
and it tells you whether the algorithm in
https://w3c.github.io/webappsec/specs/subresourceintegrity/#is-resource-eligi...
returns true.

[jww, 2015/03/06 02:16:42]

Done.

+        if (frame() && frame()->document() && logErrors) {
             String resourceType = Resource::resourceTypeToString(resource->type(), resource->options().initiatorInfo);
             frame()->document()->addConsoleMessage(ConsoleMessage::create(JSMessageSource, ErrorMessageLevel, resourceType + " from origin '" + SecurityOrigin::create(url)->toString() + "' has been blocked from loading by Cross-Origin Resource Sharing policy: " + errorDescription));
         }
@@ -1525,6 +1527,8 @@ bool ResourceFetcher::canAccessRedirect(Resource* resource, ResourceRequest& req
         if (!CrossOriginAccessControl::handleRedirect(document(), resource, sourceOrigin, request, redirectResponse, options, errorMessage)) {
             if (resource->type() == Resource::Font)
                 toFontResource(resource)->setCORSFailed();
+            if (resource->type() == Resource::CSSStyleSheet)
+                toCSSStyleSheetResource(resource)->setCORSNeededAndFailed();
             if (frame() && frame()->document())
                 frame()->document()->addConsoleMessage(ConsoleMessage::create(JSMessageSource, ErrorMessageLevel, errorMessage));
             return false;