'blob:' URLs should not match 'self' in CSP source expression lists.

Source/core/frame/csp/ContentSecurityPolicy.cpp

 /*
  * Copyright (C) 2011 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 935 matching lines @@
     return m_selfSource->matches(url, DidNotRedirect);
 }
 
 bool ContentSecurityPolicy::protocolMatchesSelf(const KURL& url) const
 {
     if (equalIgnoringCase("http", m_selfProtocol))
         return url.protocolIsInHTTPFamily();
     return equalIgnoringCase(url.protocol(), m_selfProtocol);
 }
 
+bool ContentSecurityPolicy::selfMatchesInnerURL() const
+{
+    // Due to backwards-compatibility concerns, we allow 'self' to match blob and filesystem URLs
+    // if we're in a context that bypasses Content Security Policy in the main world.
+    //
+    // TODO(mkwst): Revisit this once embedders have an opportunity to update their extension models.
+    return m_executionContext && SchemeRegistry::schemeShouldBypassContentSecurityPolicy(m_executionContext->securityOrigin()->protocol());
+}
+
 bool ContentSecurityPolicy::shouldBypassMainWorld(const ExecutionContext* context)
 {
     if (context && context->isDocument()) {
         const Document* document = toDocument(context);
         if (document->frame())
             return document->frame()->script().shouldBypassMainWorldCSP();
     }
     return false;
 }
 
@@ skipping 27 matching lines @@
     // Collisions have no security impact, so we can save space by storing only the string's hash rather than the whole report.
     return !m_violationReportsSent.contains(report.impl()->hash());
 }
 
 void ContentSecurityPolicy::didSendViolationReport(const String& report)
 {
     m_violationReportsSent.add(report.impl()->hash());
 }
 
 } // namespace blink