Disallow CSP source * matching of data:, blob:, and filesystem: URLs

third_party/WebKit/Source/core/frame/csp/CSPSourceListTest.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/frame/csp/CSPSourceList.h"
 
 #include "core/dom/Document.h"
 #include "core/frame/csp/CSPSource.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
@@ skipping 36 matching lines @@
 {
     KURL base;
     String sources = "'none'";
     CSPSourceList sourceList(csp.get(), "script-src");
     parseSourceList(sourceList, sources);
 
     EXPECT_FALSE(sourceList.matches(KURL(base, "http://example.com/")));
     EXPECT_FALSE(sourceList.matches(KURL(base, "https://example.test/")));
 }
 
+TEST_F(CSPSourceListTest, BasicMatchingStar)
+{
+    KURL base;
+    String sources = "*";
+    CSPSourceList sourceList(csp.get(), "script-src");
+    parseSourceList(sourceList, sources);
+
+    EXPECT_TRUE(sourceList.matches(KURL(base, "http://example.com/")));
+    EXPECT_TRUE(sourceList.matches(KURL(base, "https://example.com/")));
+    EXPECT_TRUE(sourceList.matches(KURL(base, "http://example.com/bar")));
+    EXPECT_TRUE(sourceList.matches(KURL(base, "http://foo.example.com/")));
+    EXPECT_TRUE(sourceList.matches(KURL(base, "http://foo.example.com/bar")));
+
+    EXPECT_FALSE(sourceList.matches(KURL(base, "data:https://example.test/")));
+    EXPECT_FALSE(sourceList.matches(KURL(base, "blob:https://example.test/")));
+    EXPECT_FALSE(sourceList.matches(KURL(base, "filesystem:https://example.test/")));
+}
+
 TEST_F(CSPSourceListTest, BasicMatchingSelf)
 {
     KURL base;
     String sources = "'self'";
     CSPSourceList sourceList(csp.get(), "script-src");
     parseSourceList(sourceList, sources);
 
     EXPECT_FALSE(sourceList.matches(KURL(base, "http://example.com/")));
     EXPECT_FALSE(sourceList.matches(KURL(base, "https://not-example.com/")));
     EXPECT_TRUE(sourceList.matches(KURL(base, "https://example.test/")));
@@ skipping 81 matching lines @@
     EXPECT_TRUE(sourceList.matches(KURL(base, "http://example1.com/foo/"), ContentSecurityPolicy::DidRedirect));
     EXPECT_TRUE(sourceList.matches(KURL(base, "http://example1.com/bar/"), ContentSecurityPolicy::DidRedirect));
     EXPECT_TRUE(sourceList.matches(KURL(base, "http://example2.com/bar/"), ContentSecurityPolicy::DidRedirect));
     EXPECT_TRUE(sourceList.matches(KURL(base, "http://example2.com/foo/"), ContentSecurityPolicy::DidRedirect));
 
     EXPECT_FALSE(sourceList.matches(KURL(base, "http://example3.com/foo/"), ContentSecurityPolicy::DidRedirect));
     EXPECT_FALSE(sourceList.matches(KURL(base, "https://example1.com/foo/"), ContentSecurityPolicy::DidRedirect));
 }
 
 } // namespace