Match `path-part` with `url` case-sensitively

Match `path-part` with `url` case-sensitively

This fixes a bug where if final character of `path-part`
in `source-expression` is the U+002F SOLIDUS character (/),
matching with path of the `url` was performed case-insensitively.
Less strict matching can lead to CSP bypass in certain
circumstances or, at least, user confusion.

This fixes the bug by ensuring that `path-part` matching is
performed case-sensitively, per
https://w3c.github.io/webappsec-csp/#match-url-to-source-expression

BUG=590505
R=mkwst@chromium.org

Committed: https://crrev.com/7bd0a75e3f71a10e71ded31ea5905d5ee3d992eb
Cr-Commit-Position: refs/heads/master@{#386032}

[Sergey Shekyan, 2016-04-08 07:36:19]

The CQ bit was checked by shekyan@gmail.com

[commit-bot: I haz the power, 2016-04-08 07:36:30]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1872563004/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1872563004/1

[commit-bot: I haz the power, 2016-04-08 07:36:30]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-04-08 07:36:31]

No L-G-T-M from a valid reviewer yet. 
CQ run can only be started by full committers or once the patch has
received an L-G-T-M from a full committer.
Even if an L-G-T-M may have been provided, it was from a non-committer,
_not_ a full super star committer.
See http://www.chromium.org/getting-involved/become-a-committer
Note that this has nothing to do with OWNERS files.

[Mike West, 2016-04-08 08:07:37]

The CQ bit was checked by mkwst@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-04-08 08:07:51]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1872563004/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1872563004/1

[Mike West, 2016-04-08 08:09:15]

LGTM. Thanks for the patch! If the bots are happy, go ahead and land it.

[Mike West, 2016-04-08 08:10:25]

On 2016/04/08 at 08:09:15, Mike West wrote:
> LGTM. Thanks for the patch! If the bots are happy, go ahead and land it.

Also, I've verified that you've signed the CLA. Please add yourself to the
AUTHORS file in the repository's root before sending this to the commit queue.

[commit-bot: I haz the power, 2016-04-08 08:19:48]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-04-08 08:19:48]

Dry run: Try jobs failed on following builders:
  chromium_presubmit on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/chromium_presub...)

[Sergey Shekyan, 2016-04-08 08:32:59]

The CQ bit was checked by shekyan@gmail.com

[Sergey Shekyan, 2016-04-08 08:33:00]

The patchset sent to the CQ was uploaded after l-g-t-m from mkwst@chromium.org
Link to the patchset: https://codereview.chromium.org/1872563004/#ps20001
(title: "Update AUTHORS")

[commit-bot: I haz the power, 2016-04-08 08:33:12]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1872563004/20001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1872563004/20001

[commit-bot: I haz the power, 2016-04-08 10:02:20]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2016-04-08 10:03:56]

Description was changed from

==========
Match `path-part` with `url` case-sensitively

This fixes a bug where if final character of `path-part`
in `source-expression` is the U+002F SOLIDUS character (/),
matching with path of the `url` was performed case-insensitively.
Less strict matching can lead to CSP bypass in certain
circumstances or, at least, user confusion.

This fixes the bug by ensuring that `path-part` matching is
performed case-sensitively, per
https://w3c.github.io/webappsec-csp/#match-url-to-source-expression

BUG=590505
R=mkwst@chromium.org
==========

to

==========
Match `path-part` with `url` case-sensitively

This fixes a bug where if final character of `path-part`
in `source-expression` is the U+002F SOLIDUS character (/),
matching with path of the `url` was performed case-insensitively.
Less strict matching can lead to CSP bypass in certain
circumstances or, at least, user confusion.

This fixes the bug by ensuring that `path-part` matching is
performed case-sensitively, per
https://w3c.github.io/webappsec-csp/#match-url-to-source-expression

BUG=590505
R=mkwst@chromium.org

Committed: https://crrev.com/7bd0a75e3f71a10e71ded31ea5905d5ee3d992eb
Cr-Commit-Position: refs/heads/master@{#386032}
==========

[commit-bot: I haz the power, 2016-04-08 10:03:57]

Patchset 2 (id:??) landed as
https://crrev.com/7bd0a75e3f71a10e71ded31ea5905d5ee3d992eb
Cr-Commit-Position: refs/heads/master@{#386032}