Part 2.3: Is policy list subsumed under subsuming policy?

third_party/WebKit/Source/core/frame/csp/SourceListDirective.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/SourceListDirective.h"
 
 #include "core/frame/csp/CSPSource.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "platform/network/ContentSecurityPolicyParsers.h"
 #include "platform/weborigin/KURL.h"
@@ skipping 540 matching lines @@
   m_nonces.add(nonce);
 }
 
 void SourceListDirective::addSourceHash(
     const ContentSecurityPolicyHashAlgorithm& algorithm,
     const DigestValue& hash) {
   m_hashes.add(CSPHashValue(algorithm, hash));
   m_hashAlgorithmsUsed |= algorithm;
 }
 
+void SourceListDirective::addSourceToMap(HashMap<String, CSPSource*>& hashMap,
+                                         CSPSource* source) {
+  hashMap.add(source->getScheme(), source);
+  if (source->getScheme() == "http")
+    hashMap.add("https", source);
+  else if (source->getScheme() == "ws")
+    hashMap.add("wss", source);
+}
+
 bool SourceListDirective::hasSourceMatchInList(
     const KURL& url,
     ResourceRequest::RedirectStatus redirectStatus) const {
   for (size_t i = 0; i < m_list.size(); ++i) {
     if (m_list[i]->matches(url, redirectStatus))
       return true;
   }
 
   return false;
 }
 
 bool SourceListDirective::subsumes(
     HeapVector<Member<SourceListDirective>> other) {
   // TODO(amalika): Handle here special keywords.
   if (!m_list.size() || !other.size())
     return !m_list.size();
 
   HeapVector<Member<CSPSource>> normalizedA = other[0]->m_list;
   for (size_t i = 1; i < other.size(); i++) {
     normalizedA = other[i]->getIntersectCSPSources(normalizedA);
   }
 
   return CSPSource::firstSubsumesSecond(m_list, normalizedA);
 }
 
+HashMap<String, CSPSource*> SourceListDirective::getIntersectSchemesOnly(
+    HeapVector<Member<CSPSource>> other) {
+  HashMap<String, CSPSource*> schemesA;
+  for (const auto& sourceA : m_list) {
+    if (sourceA->isSchemeOnly())
+      addSourceToMap(schemesA, sourceA);
+  }
+  // Add schemes only sources if they are present in both `this` and `other`,
+  // allowing upgrading `http` to `https` and `ws` to `wss`.
+  HashMap<String, CSPSource*> intersect;
+  for (const auto& sourceB : other) {
+    if (sourceB->isSchemeOnly()) {
+      if (schemesA.contains(sourceB->getScheme()))
+        addSourceToMap(intersect, sourceB);
+      else if (sourceB->getScheme() == "http" && schemesA.contains("https"))
+        intersect.add("https", schemesA.get("https"));
+      else if (sourceB->getScheme() == "ws" && schemesA.contains("wss"))
+        intersect.add("wss", schemesA.get("wss"));
+    }
+  }
+
+  return intersect;
+}
+
 HeapVector<Member<CSPSource>> SourceListDirective::getIntersectCSPSources(
-    HeapVector<Member<CSPSource>> otherVector) {
+    HeapVector<Member<CSPSource>> other) {
+  HashMap<String, CSPSource*> schemesMap = getIntersectSchemesOnly(other);
   HeapVector<Member<CSPSource>> normalized;
-  for (const auto& aCspSource : m_list) {
-    Member<CSPSource> matchedCspSource(nullptr);
-    for (const auto& bCspSource : otherVector) {
-      if ((matchedCspSource = bCspSource->intersect(aCspSource)))
+  // Add all normalized scheme source expressions.
+  for (auto it = schemesMap.begin(); it != schemesMap.end(); ++it) {
+    // We do not add secure versions if insecure schemes are present.
+    if ((it->key != "https" || !schemesMap.contains("http")) &&
+        (it->key != "wss" || !schemesMap.contains("ws"))) {
+      normalized.append(it->value);
+    }
+  }
+
+  for (const auto& sourceA : m_list) {
+    if (schemesMap.contains(sourceA->getScheme()))
+      continue;
+
+    CSPSource* match(nullptr);
+    for (const auto& sourceB : other) {
+      // No need to add a host source expression if it is subsumed by the
+      // matching scheme source expression.
+      if (schemesMap.contains(sourceB->getScheme()))
+        continue;
+      // If sourceA is scheme only but there was no intersection for it in the
+      // `other` list, we add all the sourceB with that scheme.
+      if (sourceA->isSchemeOnly()) {
+        if (CSPSource* localMatch = sourceB->intersect(sourceA))
+          normalized.append(localMatch);
+        continue;
+      }
+      if (sourceB->subsumes(sourceA)) {
+        match = sourceA;
         break;
+      }
+      if (CSPSource* localMatch = sourceB->intersect(sourceA))
+        match = localMatch;
     }
-    if (matchedCspSource)
-      normalized.append(matchedCspSource);
+    if (match)
+      normalized.append(match);
   }
   return normalized;
 }
 
 DEFINE_TRACE(SourceListDirective) {
   visitor->trace(m_policy);
   visitor->trace(m_list);
   CSPDirective::trace(visitor);
 }
 
 }  // namespace blink