CSP3: Implement 'worker-src'.

third_party/WebKit/Source/core/frame/csp/CSPDirectiveListTest.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPDirectiveList.h"
 
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "core/frame/csp/SourceListDirective.h"
 #include "platform/network/ContentSecurityPolicyParsers.h"
 #include "platform/network/ResourceRequest.h"
@@ skipping 373 matching lines @@
     // Enforce
     directiveList =
         createList(test.list, ContentSecurityPolicyHeaderTypeEnforce);
     EXPECT_EQ(test.expected, directiveList->allowRequestWithoutIntegrity(
                                  test.context, resource,
                                  ResourceRequest::RedirectStatus::NoRedirect,
                                  ContentSecurityPolicy::SuppressReport));
   }
 }
 
+TEST_F(CSPDirectiveListTest, workerSrc) {
+  struct TestCase {
+    const char* list;
+    bool allowed;
+  } cases[] = {
+      {"worker-src 'none'", false},
+      {"worker-src http://not.example.test", false},
+      {"worker-src https://example.test", true},
+      {"default-src *; worker-src 'none'", false},
+      {"default-src *; worker-src http://not.example.test", false},
+      {"default-src *; worker-src https://example.test", true},
+      {"child-src *; worker-src 'none'", false},
+      {"child-src *; worker-src http://not.example.test", false},
+      {"child-src *; worker-src https://example.test", true},
+      {"default-src *; child-src *; worker-src 'none'", false},
+      {"default-src *; child-src *; worker-src http://not.example.test", false},
+      {"default-src *; child-src *; worker-src https://example.test", true},
+
+      // Fallback to child-src.
+      {"child-src 'none'", false},
+      {"child-src http://not.example.test", false},
+      {"child-src https://example.test", true},
+      {"default-src *; child-src 'none'", false},
+      {"default-src *; child-src http://not.example.test", false},
+      {"default-src *; child-src https://example.test", true},
+
+      // Fallback to default-src.
+      {"default-src 'none'", false},
+      {"default-src http://not.example.test", false},
+      {"default-src https://example.test", true},
+  };
+
+  for (const auto& test : cases) {
+    SCOPED_TRACE(test.list);
+    KURL resource = KURL(KURL(), "https://example.test/worker.js");
+    Member<CSPDirectiveList> directiveList =
+        createList(test.list, ContentSecurityPolicyHeaderTypeEnforce);
+    EXPECT_EQ(test.allowed,
+              directiveList->allowWorkerFromSource(
+                  resource, ResourceRequest::RedirectStatus::NoRedirect,
+                  ContentSecurityPolicy::SuppressReport));
+  }
+}
+
 }  // namespace blink