commit dcde4983fb48841fc16fcd8a2e166bc02020fd8e
author Hiroshige Hayashizaki <hiroshige@chromium.org> Thu Aug 01 23:44:57 2019
committer Commit Bot <commit-bot@chromium.org> Thu Aug 01 23:44:57 2019
tree 23b6cc60f88f30188f6f07c5dabb657dea874597
parent 8e23c3ab0a41a79a3e0d1d51a28c12c518f59ba9

[CSP] Check inline script CSP in prepare-a-script

This CL moves the inline script CSP check from
PendingScript::ExecuteScriptBlock() (#execute-the-script-block)
to ScriptLoader::PrepareScript() (#prepare-a-script)
as spec'ed.

This CL removes Script::InlineSourceTextForCSP()
which is no longer used.

Behavior changes (the new behavior is spec-conformant and thus
this CL adds WPT tests):

- Previously <script>'s error events were fired
  when inline script CSP check fails,
  while after this CL the events are no longer fired.
  Test: scripthash-basic-blocked-error-event.html
  (Moved from layout test with expectation changes)

  This CL makes Chromium's behavior align with Firefox and Safari.

- If the nonce attribute is changed or the CSP list is updated
  after prepare-a-script before evaluation,
  previously the new nonce/CSP were used for CSP,
  while after this CL the old nonce/CSP
  (at the time of prepare-a-script) is used.
  Test: scriptnonce-changed-*.html

  This CL makes Chromium's behavior align with Firefox.
  (Safari's behavior is different from any other browsers)

This CL also adds scripthash-changed-*.html (just for symmetry
with scriptnonce-changed.html), which pass only on Chromium.

Bug: 964537
Change-Id: I8673956101d9d13708c452db23258f125cb3d256
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1618262
Commit-Queue: Hiroshige Hayashizaki <hiroshige@chromium.org>
Reviewed-by: Mike West <mkwst@chromium.org>
Reviewed-by: Kouhei Ueno <kouhei@chromium.org>
Cr-Commit-Position: refs/heads/master@{#683391}