CSP source *.x.y should not match host x.y

Source/core/frame/csp/CSPSource.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/frame/csp/CSPSource.h"
 
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "platform/weborigin/KURL.h"
 #include "platform/weborigin/KnownPorts.h"
@@ skipping 26 matching lines @@
 bool CSPSource::schemeMatches(const KURL& url) const
 {
     if (m_scheme.isEmpty())
         return m_policy->protocolMatchesSelf(url);
     return equalIgnoringCase(url.protocol(), m_scheme);
 }
 
 bool CSPSource::hostMatches(const KURL& url) const
 {
     const String& host = url.host();
-    if (equalIgnoringCase(host, m_host))
-        return true;
-    return m_hostWildcard == HasWildcard && host.endsWith("." + m_host, TextCaseInsensitive);
 
+    if (m_hostWildcard == HasWildcard)
+        return host.endsWith("." + m_host, TextCaseInsensitive);

[Mike West, 2015/09/23 04:36:49]

Can you add a counter here as well, tracking the number of times the old style
would match, but this style doesn't? I worry a bit that we've poisoned the well
with the existing behavior, and might need to revert this (or reach out to folks
to change their sites) if the numbers are high.

[jww, 2015/09/23 05:33:10]

Done.

+
+    return equalIgnoringCase(host, m_host);
 }
 
 bool CSPSource::pathMatches(const KURL& url) const
 {
     if (m_path.isEmpty())
         return true;
 
     String path = decodeURLEscapeSequences(url.path());
 
     if (m_path.endsWith("/"))
@@ skipping 20 matching lines @@
 
     return false;
 }
 
 bool CSPSource::isSchemeOnly() const
 {
     return m_host.isEmpty();
 }
 
 } // namespace