'blob:' URLs should not match 'self' in CSP source expression lists.

Source/core/frame/csp/ContentSecurityPolicy.h

 /*
  * Copyright (C) 2011 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 220 matching lines @@
     void enforceSandboxFlags(SandboxFlags);
     void enforceSuborigin(const String&);
     void enforceStrictMixedContentChecking();
     String evalDisabledErrorMessage() const;
 
     void setInsecureRequestsPolicy(SecurityContext::InsecureRequestsPolicy);
     SecurityContext::InsecureRequestsPolicy insecureRequestsPolicy() const { return m_insecureRequestsPolicy; };
 
     bool urlMatchesSelf(const KURL&) const;
     bool protocolMatchesSelf(const KURL&) const;
+    bool selfMatchesInnerURL() const;
 
     bool experimentalFeaturesEnabled() const;
 
     bool shouldSendCSPHeader(Resource::Type) const;
 
     static bool shouldBypassMainWorld(const ExecutionContext*);
 
     static bool isDirectiveName(const String&);
 
     // These functions are used to debug using ResourceContext to apply
@@ skipping 41 matching lines @@
     String m_disableEvalErrorMessage;
     SecurityContext::InsecureRequestsPolicy m_insecureRequestsPolicy;
 
     OwnPtr<CSPSource> m_selfSource;
     String m_selfProtocol;
 };
 
 }
 
 #endif