Enable SRI only for same origin and CORS content.

Source/core/fetch/ResourceLoader.cpp

Index: Source/core/fetch/ResourceLoader.cpp
diff --git a/Source/core/fetch/ResourceLoader.cpp b/Source/core/fetch/ResourceLoader.cpp
index 3db591605e8b223ad9dbec8547ca80c2e8e5da46..d8da6b401a647c3b3b0e7d06ee7b2f599eb7d4d4 100644
--- a/Source/core/fetch/ResourceLoader.cpp
+++ b/Source/core/fetch/ResourceLoader.cpp
@@ -30,6 +30,7 @@
 #include "config.h"
 #include "core/fetch/ResourceLoader.h"
 
+#include "core/fetch/CSSStyleSheetResource.h"
 #include "core/fetch/Resource.h"
 #include "core/fetch/ResourceLoaderHost.h"
 #include "core/fetch/ResourcePtr.h"
@@ -354,12 +355,15 @@ void ResourceLoader::didReceiveResponse(blink::WebURLLoader*, const blink::WebUR
                 resource = m_resource->resourceToRevalidate();
             else
                 m_resource->setResponse(resourceResponse);
-            if (!m_host->canAccessResource(resource, m_options.securityOrigin.get(), response.url())) {
+            if (!m_host->canAccessResource(resource, m_options.securityOrigin.get(), response.url(), true)) {
                 m_host->didReceiveResponse(m_resource, resourceResponse);
                 cancel(ResourceError::cancelledDueToAccessCheckError(KURL(response.url())));
                 return;
             }
         }
+    } else {
+        if (m_resource->type() == Resource::CSSStyleSheet && !m_host->canAccessResource(m_resource, m_options.securityOrigin.get(), response.url(), false))

[Mike West, 2015/02/26 08:44:53]

1. I think we should only do this check if we actually need to (e.g. if an
integrity attribute is present.

2. You don't need to `setCORSNeededAndFailed`, as it's done as a side-effect of
failing the `canAccessResource` check, isn't it? (Note: this is an argument for
restructuring the code, as this kind of side-effect is tough to follow).

[jww, 2015/03/06 02:16:42]

I think these are both addressed by the bigger refactor (and removal of the side
effect)

+            toCSSStyleSheetResource(m_resource)->setCORSNeededAndFailed();
     }
 
     // Reference the object in this method since the additional processing can do