Part 3.1: Is policy list subsumed under subsuming policy?

third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CSPDirectiveList_h
 #define CSPDirectiveList_h
 
 #include "core/fetch/Resource.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "core/frame/csp/MediaListDirective.h"
 #include "core/frame/csp/SourceListDirective.h"
 #include "platform/heap/Handle.h"
 #include "platform/network/ContentSecurityPolicyParsers.h"
 #include "platform/network/HTTPParsers.h"
 #include "platform/network/ResourceRequest.h"
 #include "platform/weborigin/KURL.h"
 #include "wtf/Vector.h"
 #include "wtf/text/AtomicString.h"
 #include "wtf/text/WTFString.h"
 
 namespace blink {
 
 class ContentSecurityPolicy;
 
+typedef HeapVector<Member<SourceListDirective>> SourceListDirectiveVector;
+
 class CORE_EXPORT CSPDirectiveList
     : public GarbageCollectedFinalized<CSPDirectiveList> {
   WTF_MAKE_NONCOPYABLE(CSPDirectiveList);
 
  public:
   static CSPDirectiveList* create(ContentSecurityPolicy*,
                                   const UChar* begin,
                                   const UChar* end,
                                   ContentSecurityPolicyHeaderType,
                                   ContentSecurityPolicyHeaderSource);
@@ skipping 114 matching lines @@
     return m_frameAncestors.get() && !isReportOnly();
   }
 
   // Used to copy plugin-types into a plugin document in a nested
   // browsing context.
   bool hasPluginTypes() const { return !!m_pluginTypes; }
   const String& pluginTypesText() const;
 
   bool shouldSendCSPHeader(Resource::Type) const;
 
+  // The algorithm is described here:
+  // https://w3c.github.io/webappsec-csp/embedded/#subsume-policy
+  bool subsumes(CSPDirectiveListVector);
+
   DECLARE_TRACE();
 
  private:
   FRIEND_TEST_ALL_PREFIXES(CSPDirectiveListTest, IsMatchingNoncePresent);
+  FRIEND_TEST_ALL_PREFIXES(CSPDirectiveListTest, GetSourceVector);
 
   enum RequireSRIForToken { None = 0, Script = 1 << 0, Style = 1 << 1 };
 
   CSPDirectiveList(ContentSecurityPolicy*,
                    ContentSecurityPolicyHeaderType,
                    ContentSecurityPolicyHeaderSource);
 
   bool parseDirective(const UChar* begin,
                       const UChar* end,
                       String& name,
@@ skipping 86 matching lines @@
   bool checkAncestorsAndReportViolation(SourceListDirective*,
                                         LocalFrame*,
                                         const KURL&) const;
   bool checkRequestWithoutIntegrityAndReportViolation(
       WebURLRequest::RequestContext,
       const KURL&,
       ResourceRequest::RedirectStatus) const;
 
   bool denyIfEnforcingPolicy() const { return isReportOnly(); }
 
+  SourceListDirective* operativeDirective(

[Mike West, 2016/11/24 13:07:46]

Please add unit tests, especially for the cascade behavior.

[amalika, 2016/11/24 14:32:29]

Added!

+      const ContentSecurityPolicy::DirectiveType&);
+  static SourceListDirectiveVector getSourceVector(

[Mike West, 2016/11/24 13:07:46]

Can you add a comment explaining what these functions do?

[amalika, 2016/11/24 14:32:29]

Added!

+      const ContentSecurityPolicy::DirectiveType&,
+      CSPDirectiveListVector policies);
+
   Member<ContentSecurityPolicy> m_policy;
 
   String m_header;
   ContentSecurityPolicyHeaderType m_headerType;
   ContentSecurityPolicyHeaderSource m_headerSource;
 
   bool m_hasSandboxPolicy;
 
   bool m_strictMixedContentCheckingEnforced;
 
@@ skipping 20 matching lines @@
   uint8_t m_requireSRIFor;
 
   Vector<String> m_reportEndpoints;
 
   String m_evalDisabledErrorMessage;
 };
 
 }  // namespace blink
 
 #endif