Disallow CSP source * matching of data:, blob:, and filesystem: URLs

third_party/WebKit/Source/core/frame/csp/CSPSourceListTest.cpp

Index: third_party/WebKit/Source/core/frame/csp/CSPSourceListTest.cpp
diff --git a/third_party/WebKit/Source/core/frame/csp/CSPSourceListTest.cpp b/third_party/WebKit/Source/core/frame/csp/CSPSourceListTest.cpp
index 7c49fe2cffb438fbc978d700342b4524809c715a..19ca8a7b42a7b79f45b7fe51693d69c757976c16 100644
--- a/third_party/WebKit/Source/core/frame/csp/CSPSourceListTest.cpp
+++ b/third_party/WebKit/Source/core/frame/csp/CSPSourceListTest.cpp
@@ -54,6 +54,24 @@ TEST_F(CSPSourceListTest, BasicMatchingNone)
     EXPECT_FALSE(sourceList.matches(KURL(base, "https://example.test/")));
 }
 
+TEST_F(CSPSourceListTest, BasicMatchingStar)
+{
+    KURL base;
+    String sources = "*";
+    CSPSourceList sourceList(csp.get(), "script-src");
+    parseSourceList(sourceList, sources);
+
+    EXPECT_TRUE(sourceList.matches(KURL(base, "http://example.com/")));
+    EXPECT_TRUE(sourceList.matches(KURL(base, "https://example.com/")));
+    EXPECT_TRUE(sourceList.matches(KURL(base, "http://example.com/bar")));
+    EXPECT_TRUE(sourceList.matches(KURL(base, "http://foo.example.com/")));
+    EXPECT_TRUE(sourceList.matches(KURL(base, "http://foo.example.com/bar")));
+
+    EXPECT_FALSE(sourceList.matches(KURL(base, "data:https://example.test/")));
+    EXPECT_FALSE(sourceList.matches(KURL(base, "blob:https://example.test/")));
+    EXPECT_FALSE(sourceList.matches(KURL(base, "filesystem:https://example.test/")));
+}
+
 TEST_F(CSPSourceListTest, BasicMatchingSelf)
 {
     KURL base;