Part 2.3: Is policy list subsumed under subsuming policy?

third_party/WebKit/Source/core/frame/csp/SourceListDirectiveTest.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/SourceListDirective.h"
 
 #include "core/dom/Document.h"
 #include "core/frame/csp/CSPSource.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "platform/network/ResourceRequest.h"
@@ skipping 235 matching lines @@
       {"https://example1.com/foo/ https://example2.com/bar/",
        "https://example1.com/foo/ https://example2.com/bar/"},
       {"https://example1.com/foo/ wss://example2.com/bar/",
        "https://example1.com/foo/"},
       // Normalizing hosts.
       {"http://*.example1.com/foo/ http://*.example2.com/bar/",
        "http://example1.com/foo/ http://*.example2.com/bar/"},
       {"http://*.example1.com/foo/ http://foo.example2.com/bar/",
        "http://example1.com/foo/ http://foo.example2.com/bar/"},
       // Normalizing ports.
-      {"http://example1.com:80/foo/ http://example2.com/bar/",
-       "http://example1.com:80/foo/ http://example2.com/bar/"},
+      {"http://example1.com/foo/ http://example2.com/bar/",
+       "http://example1.com/foo/ http://example2.com/bar/"},
       {"http://example1.com/foo/ http://example2.com:90/bar/",
        "http://example1.com/foo/"},
       {"http://example1.com:*/foo/ http://example2.com/bar/",
        "http://example1.com/foo/ http://example2.com/bar/"},
       {"http://*.example3.com:100/bar/ http://example1.com/foo/",
        "http://example1.com/foo/ http://*.example3.com:100/bar/"},
       // Normalizing paths.
       {"http://example1.com/ http://example2.com/",
        "http://example1.com/foo/ http://example2.com/bar/"},
       {"http://example1.com/foo/index.html http://example2.com/bar/",
@@ skipping 18 matching lines @@
                   normalized[i]->m_port,         normalized[i]->m_path,
                   normalized[i]->m_hostWildcard, normalized[i]->m_portWildcard};
       Source b = {expected[i]->m_scheme,       expected[i]->m_host,
                   expected[i]->m_port,         expected[i]->m_path,
                   expected[i]->m_hostWildcard, expected[i]->m_portWildcard};
       EXPECT_TRUE(equalSources(a, b));
     }
   }
 }
 
+TEST_F(SourceListDirectiveTest, GetIntersectCSPSourcesSchemes) {
+  KURL base;
+  String sources =
+      "http: http://example1.com/foo/ https://example1.com/foo/ "
+      "http://example1.com/bar/page.html";
+  SourceListDirective sourceList("script-src", sources, csp.get());

[Mike West, 2016/11/17 10:58:31]

Might as well just inline the source string here.

+  struct TestCase {
+    String sources;
+    String expected;
+  } cases[] = {
+      {"http:",
+       "http: http://example1.com/foo/ https://example1.com/foo/ "
+       "http://example1.com/bar/page.html"},
+      {"https:",
+       "https: https://example1.com/foo/ https://example1.com/foo/ "
+       "https://example1.com/bar/page.html"},
+      {"https: http://example1.com/foo/",
+       "https: http://example1.com/foo/ https://example1.com/foo/ "
+       "https://example1.com/bar/page.html"},
+      {"http://*.example1.com/",
+       "http://*.example1.com/ http://example1.com/foo/ "
+       "https://example1.com/foo/ http://example1.com/bar/page.html"},
+      {"http://example1.com/foo/ https://example1.com/foo/",
+       "https://example1.com/foo/ http://example1.com/foo/ "
+       "https://example1.com/foo/"},
+      {"https://example1.com/foo/ https://example1.com/foo/",
+       "https://example1.com/foo/ https://example1.com/foo/ "
+       "https://example1.com/foo/"},
+      {"https://example1.com/foo/ http://example1.com/foo/",
+       "http://example1.com/foo/ http://example1.com/foo/ "
+       "https://example1.com/foo/"},
+  };
+
+  for (const auto& test : cases) {
+    SourceListDirective secondList("script-src", test.sources, csp.get());
+    HeapVector<Member<CSPSource>> normalized =
+        sourceList.getIntersectCSPSources(secondList.m_list);

[Mike West, 2016/11/17 10:58:31]

This should be symmetric right? Could you add checks for
`secondList.getIntersectCSPSources(sourceList)`?

+    SourceListDirective helperSourceList("script-src", test.expected,
+                                         csp.get());
+    HeapVector<Member<CSPSource>> expected = helperSourceList.m_list;
+    EXPECT_EQ(normalized.size(), expected.size());
+    for (size_t i = 0; i < normalized.size(); i++) {
+      Source a = {normalized[i]->m_scheme,       normalized[i]->m_host,
+                  normalized[i]->m_port,         normalized[i]->m_path,
+                  normalized[i]->m_hostWildcard, normalized[i]->m_portWildcard};
+      Source b = {expected[i]->m_scheme,       expected[i]->m_host,
+                  expected[i]->m_port,         expected[i]->m_path,
+                  expected[i]->m_hostWildcard, expected[i]->m_portWildcard};
+      EXPECT_TRUE(equalSources(a, b));
+    }
+  }
+}
+
 }  // namespace blink