CSP: 'self' should be handled correctly in sandboxes.

Source/core/frame/ContentSecurityPolicy.cpp

 /*
  * Copyright (C) 2011 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 223 matching lines @@
             return false;
         if (isSchemeOnly())
             return true;
         return hostMatches(url) && portMatches(url) && pathMatches(url);
     }
 
 private:
     bool schemeMatches(const KURL& url) const
     {
         if (m_scheme.isEmpty()) {
-            String protectedResourceScheme(m_policy->securityOrigin()->protocol());
+            String protectedResourceScheme(m_policy->url().protocol());
             if (equalIgnoringCase("http", protectedResourceScheme))
                 return url.protocolIs("http") || url.protocolIs("https");
             return equalIgnoringCase(url.protocol(), protectedResourceScheme);
         }
         return equalIgnoringCase(url.protocol(), m_scheme);
     }
 
     bool hostMatches(const KURL& url) const
     {
         const String& host = url.host();
@@ skipping 453 matching lines @@
     if (position != end)
         return false;
 
     bool ok;
     port = charactersToIntStrict(begin, end - begin, &ok);
     return ok;
 }
 
 void CSPSourceList::addSourceSelf()
 {
-    m_list.append(CSPSource(m_policy, m_policy->securityOrigin()->protocol(), m_policy->securityOrigin()->host(), m_policy->securityOrigin()->port(), String(), false, false));
+    if (Document* document = m_policy->document()) {
+        // srcdoc documents should use their parent document's URL as 'self', so walk the chain.
+        Frame* frame = document->frame();
+        while (frame->document()->isSrcdocDocument() && frame->tree().parent())
+            frame = frame->tree().parent();
+        document = frame->document();
+        m_list.append(CSPSource(m_policy, document->url().protocol(), document->url().host(), document->url().port(), String(), false, false));
+    } else {
+        m_list.append(CSPSource(m_policy, m_policy->url().protocol(), m_policy->url().host(), m_policy->url().port(), String(), false, false));
+    }
 }
 
 void CSPSourceList::addSourceStar()
 {
     m_allowStar = true;
 }
 
 void CSPSourceList::addSourceUnsafeInline()
 {
     m_allowInline = true;
@@ skipping 1577 matching lines @@
     // Collisions have no security impact, so we can save space by storing only the string's hash rather than the whole report.
     return !m_violationReportsSent.contains(report.impl()->hash());
 }
 
 void ContentSecurityPolicy::didSendViolationReport(const String& report)
 {
     m_violationReportsSent.add(report.impl()->hash());
 }
 
 } // namespace WebCore