'blob:' URLs should not match 'self' in CSP source expression lists.

Source/core/frame/csp/CSPSourceListTest.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/frame/csp/CSPSourceList.h"
 
 #include "core/dom/Document.h"
 #include "core/frame/csp/CSPSource.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "platform/weborigin/KURL.h"
+#include "platform/weborigin/SchemeRegistry.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include <gtest/gtest.h>
 
 namespace blink {
 
 class CSPSourceListTest : public ::testing::Test {
 public:
     CSPSourceListTest()
         : csp(ContentSecurityPolicy::create())
     {
@@ skipping 36 matching lines @@
     KURL base;
     String sources = "'self'";
     CSPSourceList sourceList(csp.get(), "script-src");
     parseSourceList(sourceList, sources);
 
     EXPECT_FALSE(sourceList.matches(KURL(base, "http://example.com/")));
     EXPECT_FALSE(sourceList.matches(KURL(base, "https://not-example.com/")));
     EXPECT_TRUE(sourceList.matches(KURL(base, "https://example.test/")));
 }
 
+TEST_F(CSPSourceListTest, BlobMatchingSelf)
+{
+    KURL base;
+    String sources = "'self'";
+    CSPSourceList sourceList(csp.get(), "script-src");
+    parseSourceList(sourceList, sources);
+
+    EXPECT_TRUE(sourceList.matches(KURL(base, "https://example.test/")));
+    EXPECT_FALSE(sourceList.matches(KURL(base, "blob:https://example.test/")));
+
+    // Register "https" as bypassing CSP, which should trigger the innerURL behavior.
+    SchemeRegistry::registerURLSchemeAsBypassingContentSecurityPolicy("https");
+
+    EXPECT_TRUE(sourceList.matches(KURL(base, "https://example.test/")));
+    EXPECT_TRUE(sourceList.matches(KURL(base, "blob:https://example.test/")));
+
+    // Unregister the scheme to clean up after ourselves.
+    SchemeRegistry::removeURLSchemeRegisteredAsBypassingContentSecurityPolicy("https");
+}
+
+TEST_F(CSPSourceListTest, BlobMatchingBlob)
+{
+    KURL base;
+    String sources = "blob:";
+    CSPSourceList sourceList(csp.get(), "script-src");
+    parseSourceList(sourceList, sources);
+
+    EXPECT_FALSE(sourceList.matches(KURL(base, "https://example.test/")));
+    EXPECT_TRUE(sourceList.matches(KURL(base, "blob:https://example.test/")));
+}
+
 TEST_F(CSPSourceListTest, BasicMatching)
 {
     KURL base;
     String sources = "http://example1.com:8000/foo/ https://example2.com/";
     CSPSourceList sourceList(csp.get(), "script-src");
     parseSourceList(sourceList, sources);
 
     EXPECT_TRUE(sourceList.matches(KURL(base, "http://example1.com:8000/foo/")));
     EXPECT_TRUE(sourceList.matches(KURL(base, "http://example1.com:8000/foo/bar")));
     EXPECT_TRUE(sourceList.matches(KURL(base, "https://example2.com/")));
@@ skipping 38 matching lines @@
     EXPECT_TRUE(sourceList.matches(KURL(base, "http://example1.com/foo/"), ContentSecurityPolicy::DidRedirect));
     EXPECT_TRUE(sourceList.matches(KURL(base, "http://example1.com/bar/"), ContentSecurityPolicy::DidRedirect));
     EXPECT_TRUE(sourceList.matches(KURL(base, "http://example2.com/bar/"), ContentSecurityPolicy::DidRedirect));
     EXPECT_TRUE(sourceList.matches(KURL(base, "http://example2.com/foo/"), ContentSecurityPolicy::DidRedirect));
 
     EXPECT_FALSE(sourceList.matches(KURL(base, "http://example3.com/foo/"), ContentSecurityPolicy::DidRedirect));
     EXPECT_FALSE(sourceList.matches(KURL(base, "https://example1.com/foo/"), ContentSecurityPolicy::DidRedirect));
 }
 
 } // namespace