CSP source *.x.y should not match host x.y

third_party/WebKit/Source/core/frame/csp/CSPSource.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/frame/csp/CSPSource.h"
 
+#include "core/frame/UseCounter.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "platform/weborigin/KURL.h"
 #include "platform/weborigin/KnownPorts.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include "wtf/text/WTFString.h"
 
 namespace blink {
 
 CSPSource::CSPSource(ContentSecurityPolicy* policy, const String& scheme, const String& host, int port, const String& path, WildcardDisposition hostWildcard, WildcardDisposition portWildcard)
     : m_policy(policy)
@@ skipping 19 matching lines @@
 bool CSPSource::schemeMatches(const KURL& url) const
 {
     if (m_scheme.isEmpty())
         return m_policy->protocolMatchesSelf(url);
     return equalIgnoringCase(url.protocol(), m_scheme);
 }
 
 bool CSPSource::hostMatches(const KURL& url) const
 {
     const String& host = url.host();
-    if (equalIgnoringCase(host, m_host))
-        return true;
-    return m_hostWildcard == HasWildcard && host.endsWith("." + m_host, TextCaseInsensitive);
+    Document* document = m_policy->document();
+    bool match;
 
+    bool equalHosts = equalIgnoringCase(host, m_host);
+    if (m_hostWildcard == HasWildcard) {
+        match = host.endsWith("." + m_host, TextCaseInsensitive);
+
+        // Chrome used to, incorrectly, match *.x.y to x.y. This was fixed, but
+        // the following count measures when a match fails that would have
+        // passed the old, incorrect style, in case a lot of sites were
+        // relying on that behavior.
+        if (document && equalHosts)
+            UseCounter::count(*document, UseCounter::CSPSourceWildcardWouldMatchExactHost);
+    } else {
+        match = equalHosts;
+    }
+
+    return match;
 }
 
 bool CSPSource::pathMatches(const KURL& url) const
 {
     if (m_path.isEmpty())
         return true;
 
     String path = decodeURLEscapeSequences(url.path());
 
     if (m_path.endsWith("/"))
@@ skipping 20 matching lines @@
 
     return false;
 }
 
 bool CSPSource::isSchemeOnly() const
 {
     return m_host.isEmpty();
 }
 
 } // namespace