Part 2.2: Is policy list subsumed under subsuming policy?

third_party/WebKit/Source/core/frame/csp/CSPSourceTest.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPSource.h"
 
 #include "core/dom/Document.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "platform/network/ResourceRequest.h"
 #include "platform/weborigin/KURL.h"
@@ skipping 427 matching lines @@
     CSPSource* required = new CSPSource(
         csp.get(), test.b.scheme, test.b.host, test.b.port, test.b.path,
         CSPSource::NoWildcard, CSPSource::NoWildcard);
 
     EXPECT_EQ(returned->isSimilar(required), test.isSimilar);
     // Verify the same test with a and b swapped.
     EXPECT_EQ(required->isSimilar(returned), test.isSimilar);
   }
 }
 
+TEST_F(CSPSourceTest, FirstSubsumesSecond) {
+  struct Source {
+    const char* scheme;
+    const char* host;
+    const char* path;
+  };
+  struct TestCase {
+    const Source returned;
+    String requiredScheme;
+    bool expected;
+  } cases[] = {
+      // Subsumed.
+      {{"http", "example.com", "/"}, "http", true},
+      {{"http", "example.com", "/page.html"}, "http", true},
+      {{"http", "second-example.com", "/"}, "http", true},
+      {{"https", "second-example.com", "/"}, "http", true},
+      {{"http", "second-example.com", "/page.html"}, "http", true},
+      {{"https", "second-example.com", "/page.html"}, "http", true},
+      {{"https", "second-example.com", "/"}, "https", true},
+      {{"https", "second-example.com", "/page.html"}, "https", true},
+      // NOT subsumed.

[Mike West, 2016/11/10 15:04:54]

Scheme-only expressions?
Ports?

+      {{"wss", "second-example.com", "/"}, "http", false},
+      {{"http", "non-example.com", "/"}, "http", false},
+      {{"http", "second-example.com", "/"}, "https", false},
+  };
+
+  for (const auto& test : cases) {
+    // Setup default vectors.
+    HeapVector<Member<CSPSource>> required;
+    HeapVector<Member<CSPSource>> returned;

[Mike West, 2016/11/10 15:04:54]

I think |A| and |B| are probably simpler here. |required| and |returned| require
a little too much knowledge of the feature this is implementing.

+    returned.append(new CSPSource(csp.get(), "http", "example.com", 0, "/",

[Mike West, 2016/11/10 15:04:55]

You're creating these sources every time you go through the loop. Could you
extract them into a few variables that you instantiate once?

+                                  CSPSource::NoWildcard,
+                                  CSPSource::NoWildcard));
+    // Empty `required` implies `none` is allowed.
+    EXPECT_FALSE(CSPSource::firstSubsumesSecond(required, returned));
+
+    required.append(new CSPSource(csp.get(), "http", "example.com", 0, "/",
+                                  CSPSource::NoWildcard,
+                                  CSPSource::NoWildcard));
+    // Add CSPSources based on the current test.
+    returned.append(new CSPSource(
+        csp.get(), test.returned.scheme, test.returned.host, 0,
+        test.returned.path, CSPSource::NoWildcard, CSPSource::NoWildcard));
+    required.append(
+        new CSPSource(csp.get(), test.requiredScheme, "second-example.com", 0,
+                      "/", CSPSource::NoWildcard, CSPSource::NoWildcard));
+    // returned contains: ["http://example.com/", test.returned]
+    // required contains: ["http://example.com/",
+    // test.requiredScheme+"second-example.com/"]
+    EXPECT_EQ(test.expected,
+              CSPSource::firstSubsumesSecond(required, returned));
+
+    // If we add another source to `returned` with a host wildcard,
+    // then the result should definitely be false.
+    returned.append(new CSPSource(csp.get(), "http", "third-example.com", 0,
+                                  "/", CSPSource::HasWildcard,
+                                  CSPSource::NoWildcard));
+    EXPECT_FALSE(CSPSource::firstSubsumesSecond(required, returned));
+
+    // If we add another source to `required` with a port wildcard,
+    // it does not make `returned` to be subsumed under `required`.
+    returned.append(new CSPSource(csp.get(), "http", "third-example.com", 0,
+                                  "/", CSPSource::NoWildcard,
+                                  CSPSource::HasWildcard));
+    EXPECT_FALSE(CSPSource::firstSubsumesSecond(required, returned));
+
+    // If however we add another source to `required` with both wildcards,
+    // that CSPSource is subsumed, so the answer should be as expected
+    // before.
+    required.append(Member<CSPSource>(
+        new CSPSource(csp.get(), "http", "third-example.com", 0, "/",
+                      CSPSource::HasWildcard, CSPSource::HasWildcard)));
+    EXPECT_EQ(test.expected,
+              CSPSource::firstSubsumesSecond(required, returned));
+  }
+}
+
 }  // namespace blink