CSP source *.x.y should not match host x.y

third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.h

 /*
  * Copyright (C) 2011 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 242 matching lines @@
 
     // These functions are used to debug using ResourceContext to apply
     // CSP directives instead of Resource::Type, by checking that the
     // ResourceContext is as expected. See crbug.com/474412
     static bool isScriptResource(const ResourceRequest&);
     static bool isStyleResource(const ResourceRequest&);
     static bool isImageResource(const ResourceRequest&);
     static bool isFontResource(const ResourceRequest&);
     static bool isMediaResource(const ResourceRequest&);
 
+    Document* document() const;
+
 private:
     ContentSecurityPolicy();
 
     void applyPolicySideEffectsToExecutionContext();
 
-    Document* document() const;
     SecurityOrigin* securityOrigin() const;
     KURL completeURL(const String&) const;
 
     void logToConsole(const String& message, MessageLevel = ErrorMessageLevel);
     void addPolicyFromHeaderValue(const String&, ContentSecurityPolicyHeaderType, ContentSecurityPolicyHeaderSource);
 
     bool shouldSendViolationReport(const String&) const;
     void didSendViolationReport(const String&);
 
     RawPtrWillBeMember<ExecutionContext> m_executionContext;
@@ skipping 17 matching lines @@
     String m_disableEvalErrorMessage;
     SecurityContext::InsecureRequestsPolicy m_insecureRequestsPolicy;
 
     OwnPtr<CSPSource> m_selfSource;
     String m_selfProtocol;
 };
 
 }
 
 #endif