Part 1.1: Is policy list subsumed under subsuming policy?

third_party/WebKit/Source/core/frame/csp/CSPSource.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CSPSource_h
 #define CSPSource_h
 
 #include "core/CoreExport.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "platform/heap/Handle.h"
@@ skipping 13 matching lines @@
   CSPSource(ContentSecurityPolicy*,
             const String& scheme,
             const String& host,
             int port,
             const String& path,
             WildcardDisposition hostWildcard,
             WildcardDisposition portWildcard);
   bool matches(const KURL&,
                ResourceRequest::RedirectStatus =
                    ResourceRequest::RedirectStatus::NoRedirect) const;
+  bool isSubsumed(CSPSource*);

[Mike West, 2016/10/26 11:40:30]

Nit: Please add a comment here, and probably point off to
https://w3c.github.io/webappsec-csp/embedded/#subsume-policy. In particular,
does `true` mean that `this` is subsumed _by_ `b`, or that `this` _subsumes_
`b`? Perhaps changing the name to `subsumes()` or `isSubsumedBy()` could
clarify?

+  // Find the normalized CSPSource of the two.

[Mike West, 2016/10/26 11:40:30]

1. What does "normalize" mean?
2. It would be great to document the algorithm in the spec, and point off to it
as explanation.

+  CSPSource* getCommon(CSPSource*);
 
   DECLARE_TRACE();
 
  private:
   bool schemeMatches(const KURL&) const;
   bool hostMatches(const KURL&) const;
   bool pathMatches(const KURL&) const;
   bool portMatches(const KURL&) const;
   bool isSchemeOnly() const;
 
+  bool schemeMatches(const String&) const;
+  bool hostMatches(const String&) const;
+  bool pathMatches(const String&) const;
+  bool portMatches(int, const String&) const;

[Mike West, 2016/10/26 11:40:30]

Would you mind pulling this refactoring out into a separate patch that we can
land today while we discuss the rest?

+
+  bool isSimilar(CSPSource* other);

[Mike West, 2016/10/26 11:40:30]

It's probably worth adding unit tests for this piece, and describing what
"similar" means.

+
   Member<ContentSecurityPolicy> m_policy;
   String m_scheme;
   String m_host;
   int m_port;
   String m_path;
 
   WildcardDisposition m_hostWildcard;
   WildcardDisposition m_portWildcard;
 };
 
 }  // namespace blink
 
 #endif