Add isUnique check to isSameSchemeHostPort.

third_party/WebKit/Source/platform/weborigin/SecurityOriginTest.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 63 matching lines @@
     EXPECT_TRUE(file1->isSameSchemeHostPort(file2.get()));
     EXPECT_TRUE(file2->isSameSchemeHostPort(file1.get()));
 
     EXPECT_TRUE(file1->canAccess(file1.get()));
     EXPECT_TRUE(file1->canAccess(file2.get()));
     EXPECT_TRUE(file2->canAccess(file1.get()));
 
     // Block |file1|'s access to local origins. It should now be same-origin
     // with itself, but shouldn't have access to |file2|.
     file1->blockLocalAccessFromLocalOrigin();
-    EXPECT_FALSE(file1->isSameSchemeHostPort(file1.get()));
+    EXPECT_TRUE(file1->isSameSchemeHostPort(file1.get()));
     EXPECT_FALSE(file1->isSameSchemeHostPort(file2.get()));
     EXPECT_FALSE(file2->isSameSchemeHostPort(file1.get()));
 
     EXPECT_TRUE(file1->canAccess(file1.get()));
     EXPECT_FALSE(file1->canAccess(file2.get()));
     EXPECT_FALSE(file2->canAccess(file1.get()));
 }
 
 TEST_F(SecurityOriginTest, IsPotentiallyTrustworthy)
 {
@@ skipping 333 matching lines @@
         EXPECT_EQ(test.expectedOriginString, origin->toString());
 
         KURL blobUrl = BlobURL::createPublicURL(origin.get());
         RefPtr<SecurityOrigin> blobUrlOrigin = SecurityOrigin::create(blobUrl);
         EXPECT_EQ(blobUrlOrigin->isUnique(), origin->isUnique());
         EXPECT_EQ(blobUrlOrigin->toString(), origin->toString());
         EXPECT_EQ(blobUrlOrigin->toRawString(), origin->toRawString());
     }
 }
 
+TEST_F(SecurityOriginTest, UniqueOriginIsSameSchemeHostPort)
+{
+    RefPtr<SecurityOrigin> uniqueOrigin = SecurityOrigin::createUnique();
+    RefPtr<SecurityOrigin> tupleOrigin = SecurityOrigin::createFromString("http://example.com");
+
+    EXPECT_TRUE(uniqueOrigin->isSameSchemeHostPort(uniqueOrigin.get()));

[Mike West, 2016/06/03 05:22:04]

Why is this true? I'd expect it to be false (because unique origins aren't
same-origin with any other origin, including themselves).

[Marijn Kruisselbrink, 2016/06/03 05:25:11]

According to the HTML specification of origins an unique origin (there called an
opaque origin) is in fact same-origin with itself
(https://html.spec.whatwg.org/multipage/browsers.html#same-origin). And we
certainly treat them that way various places in the code-base (a sandboxed
iframe with an opaque origin for example can create a blob URL with the same
origin as itself, which it can then read/use to create a same-origin worker,
etc).

+    EXPECT_FALSE(SecurityOrigin::createUnique()->isSameSchemeHostPort(uniqueOrigin.get()));
+    EXPECT_FALSE(tupleOrigin->isSameSchemeHostPort(uniqueOrigin.get()));
+    EXPECT_FALSE(uniqueOrigin->isSameSchemeHostPort(tupleOrigin.get()));
+}
+
 } // namespace blink