Part 2.1: Is policy list subsumed under subsuming policy?

third_party/WebKit/Source/core/frame/csp/CSPSource.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPSource.h"
 
 #include "core/frame/UseCounter.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "platform/weborigin/KURL.h"
 #include "platform/weborigin/KnownPorts.h"
@@ skipping 107 matching lines @@
   }
 
   bool hostIsSubsumingOf =
       (m_host == other->m_host || hostMatches(other->m_host));
   bool portIsSubsumingOf = (m_portWildcard == HasWildcard) ||
                            portMatches(other->m_port, other->m_scheme);
   bool pathIsSubsumingOf = pathMatches(other->m_path);
   return hostIsSubsumingOf && portIsSubsumingOf && pathIsSubsumingOf;
 }
 
+bool CSPSource::isSimilar(CSPSource* other) {
+  bool schemesMatch =
+      schemeMatches(other->m_scheme) || other->schemeMatches(m_scheme);
+  if (!schemesMatch || isSchemeOnly() || other->isSchemeOnly())
+    return schemesMatch;
+  bool hostsMatch = (m_host == other->m_host) || hostMatches(other->m_host) ||
+                    other->hostMatches(m_host);
+  bool portsMatch = (other->m_portWildcard == HasWildcard) ||
+                    portMatches(other->m_port, other->m_scheme);
+  bool pathsMatch = pathMatches(other->m_path) || other->pathMatches(m_path);
+  if (hostsMatch && portsMatch && pathsMatch)
+    return true;
+
+  return false;
+}
+
+CSPSource* CSPSource::getNormalized(CSPSource* other) {
+  if (!isSimilar(other))
+    return nullptr;
+
+  String scheme = other->schemeMatches(m_scheme) ? m_scheme : other->m_scheme;

[amalika, 2016/11/04 10:42:40]

It is easier to define `isSimilar` since every part (scheme, host, etc) might be
individually stricter in either CSPSource. But this results in re-evaluation of
schemeMatches and pathmatches. 

A more efficient approach would be just comparing everything here and saving
which CSPSource had stricter for each part (which one has more secure scheme, or
longer more defined path), but a bit less readable due to number of booleans.

+  String host = m_hostWildcard == NoWildcard ? m_host : other->m_host;
+  String path = other->pathMatches(m_path) ? m_path : other->m_path;
+  int port = m_portWildcard == NoWildcard ? m_port : other->m_port;

[jochen (gone - plz use gerrit), 2016/11/04 13:14:51]

could it happen that m_port is 0 but other->m_port is not?

+  WildcardDisposition hostWildcard =
+      (m_hostWildcard == HasWildcard) ? other->m_hostWildcard : m_hostWildcard;
+  WildcardDisposition portWildcard =
+      (m_portWildcard == HasWildcard) ? other->m_portWildcard : m_portWildcard;
+  return new CSPSource(m_policy, scheme, host, port, path, hostWildcard,
+                       portWildcard);
+}
+
 bool CSPSource::isSchemeOnly() const {
   return m_host.isEmpty();
 }
 
 DEFINE_TRACE(CSPSource) {
   visitor->trace(m_policy);
 }
 
 }  // namespace blink