CSP: Source expressions can no longer lock sites into insecurity.

third_party/WebKit/Source/core/frame/csp/CSPSourceTest.cpp

Index: third_party/WebKit/Source/core/frame/csp/CSPSourceTest.cpp
diff --git a/third_party/WebKit/Source/core/frame/csp/CSPSourceTest.cpp b/third_party/WebKit/Source/core/frame/csp/CSPSourceTest.cpp
index 0fbe8172351d56f27842384189f58353cea83f09..9531866a67d94dd7cf916929ee342d015b5cb198 100644
--- a/third_party/WebKit/Source/core/frame/csp/CSPSourceTest.cpp
+++ b/third_party/WebKit/Source/core/frame/csp/CSPSourceTest.cpp
@@ -63,10 +63,33 @@ TEST_F(CSPSourceTest, RedirectMatching)
 
     EXPECT_TRUE(source.matches(KURL(base, "http://example.com:8000/"), ContentSecurityPolicy::DidRedirect));
     EXPECT_TRUE(source.matches(KURL(base, "http://example.com:8000/foo"), ContentSecurityPolicy::DidRedirect));
+    EXPECT_TRUE(source.matches(KURL(base, "https://example.com:8000/foo"), ContentSecurityPolicy::DidRedirect));
 
-    EXPECT_FALSE(source.matches(KURL(base, "https://example.com:8000/foo"), ContentSecurityPolicy::DidRedirect));
     EXPECT_FALSE(source.matches(KURL(base, "http://not-example.com:8000/foo"), ContentSecurityPolicy::DidRedirect));
     EXPECT_FALSE(source.matches(KURL(base, "http://example.com:9000/foo/"), ContentSecurityPolicy::DidNotRedirect));
 }
 
+TEST_F(CSPSourceTest, InsecureSourceMatchesSecure)
+{
+    KURL base;
+    CSPSource source(csp.get(), "http", "", 0, "/", CSPSource::NoWildcard, CSPSource::HasWildcard);
+
+    EXPECT_TRUE(source.matches(KURL(base, "http://example.com:8000/")));
+    EXPECT_TRUE(source.matches(KURL(base, "https://example.com:8000/")));
+    EXPECT_TRUE(source.matches(KURL(base, "http://not-example.com:8000/")));
+    EXPECT_TRUE(source.matches(KURL(base, "https://not-example.com:8000/")));
+    EXPECT_FALSE(source.matches(KURL(base, "ftp://example.com:8000/")));
+}
+
+TEST_F(CSPSourceTest, InsecureHostMatchesSecure)
+{
+    KURL base;
+    CSPSource source(csp.get(), "http", "example.com", 0, "/", CSPSource::NoWildcard, CSPSource::HasWildcard);
+
+    EXPECT_TRUE(source.matches(KURL(base, "http://example.com:8000/")));
+    EXPECT_FALSE(source.matches(KURL(base, "http://not-example.com:8000/")));
+    EXPECT_TRUE(source.matches(KURL(base, "https://example.com:8000/")));
+    EXPECT_FALSE(source.matches(KURL(base, "https://not-example.com:8000/")));
+}
+
 } // namespace