'blob:' URLs should not match 'self' in CSP source expression lists.

'blob:' URLs should not match 'self' in CSP source expression lists.

Chrome is currently treating `'self'` as including `blob:` URLs. That's
against the spec (and Firefox), which requires whitelisting `blob:`
explicitly:

https://w3c.github.io/webappsec/specs/content-security-policy/#source-list-guid-matching.

This patch fixes our implementation.

Mozilla discussion here: https://bugzilla.mozilla.org/show_bug.cgi?id=1150957

BUG=473904
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=197354

[Mike West, 2015-06-16 13:05:57]

mkwst@chromium.org changed reviewers:
+ jochen@chromium.org

[Mike West, 2015-06-16 13:05:58]

Jochen, WDYT?

This is probably going to break things in Chromium until
https://codereview.chromium.org/1184353002 lands. Might break things in CrOS as
well. Hooray for bad decisions I made ~2 years ago.

I'll send a PSA to blink-dev@ when you're happy with the change.

[jochen (gone - plz use gerrit), 2015-06-16 13:21:47]

lgtm

[Mike West, 2015-06-18 12:32:12]

On 2015/06/16 at 13:21:47, jochen wrote:
> lgtm

After the research I noted in https://codereview.chromium.org/1176203008#msg4,
I've carved out an exception for `chrome-extension:` and
`chrome-extension-resource:` URLs by applying the correct behavior for webby
contexts, and the incorrect behavior for contexts whose URL schemes are
registered as bypassing CSP. The unit test now verifies this behavior.

WDYT, Jochen? I sent a PSA to blink-dev@ as well, and I'd like to get this into
45, but I'll hold off if you think it's controversial enough to argue about a
bit. :)

[jochen (gone - plz use gerrit), 2015-06-18 12:57:05]

lgtm

[Mike West, 2015-06-18 13:26:14]

The CQ bit was checked by mkwst@chromium.org

[commit-bot: I haz the power, 2015-06-18 13:26:40]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1178373004/20001

[commit-bot: I haz the power, 2015-06-18 13:50:18]

Committed patchset #2 (id:20001) as
https://src.chromium.org/viewvc/blink?view=rev&revision=197354