Part 2.3: Is policy list subsumed under subsuming policy?

third_party/WebKit/Source/core/frame/csp/SourceListDirectiveTest.cpp

Index: third_party/WebKit/Source/core/frame/csp/SourceListDirectiveTest.cpp
diff --git a/third_party/WebKit/Source/core/frame/csp/SourceListDirectiveTest.cpp b/third_party/WebKit/Source/core/frame/csp/SourceListDirectiveTest.cpp
index c9f16700d83011311de3b31c057881a96761cb0b..734bf034ebf5f3bb1f3c12c14e955b303beca4ea 100644
--- a/third_party/WebKit/Source/core/frame/csp/SourceListDirectiveTest.cpp
+++ b/third_party/WebKit/Source/core/frame/csp/SourceListDirectiveTest.cpp
@@ -253,8 +253,8 @@ TEST_F(SourceListDirectiveTest, GetIntersectCSPSources) {
       {"http://*.example1.com/foo/ http://foo.example2.com/bar/",
        "http://example1.com/foo/ http://foo.example2.com/bar/"},
       // Normalizing ports.
-      {"http://example1.com:80/foo/ http://example2.com/bar/",
-       "http://example1.com:80/foo/ http://example2.com/bar/"},
+      {"http://example1.com/foo/ http://example2.com/bar/",
+       "http://example1.com/foo/ http://example2.com/bar/"},
       {"http://example1.com/foo/ http://example2.com:90/bar/",
        "http://example1.com/foo/"},
       {"http://example1.com:*/foo/ http://example2.com/bar/",
@@ -293,4 +293,59 @@ TEST_F(SourceListDirectiveTest, GetIntersectCSPSources) {
   }
 }
 
+TEST_F(SourceListDirectiveTest, GetIntersectCSPSourcesSchemes) {
+  SourceListDirective listA("script-src",
+                            "http: http://example1.com/foo/ "
+                            "https://example1.com/foo/ "
+                            "http://example1.com/bar/page.html "
+                            "wss: ws://another.test/bar/",
+                            csp.get());
+  struct TestCase {
+    String sources;
+    String expected;
+    String expectedReversed;
+  } cases[] = {{"http:", "http:"},
+               {"https:", "https:"},
+               {"ws:", "wss: ws://another.test/bar/"},
+               {"wss:", "wss:"},
+               {"https: ws:", "wss: https: ws://another.test/bar/"},
+               {"https: http: wss:", "http: wss:"},
+               {"https: http: wss:", "http: wss:"},
+               {"https: http://another-example1.com/bar/",
+                "https: http://another-example1.com/bar/"},

[amalika, 2016/11/19 18:34:32]

The above tests the proper functionality of `getIntersectSchemesOnly`

+               {"http://*.example1.com/",
+                "http://*.example1.com/ http://example1.com/foo/ "
+                "https://example1.com/foo/ http://example1.com/bar/page.html"},
+               {"http://example1.com/foo/ https://example1.com/foo/",
+                "http://example1.com/foo/ https://example1.com/foo/ "
+                "http://example1.com/foo/ https://example1.com/foo/"},
+               {"https://example1.com/foo/ http://example1.com/foo/",
+                "https://example1.com/foo/ http://example1.com/foo/ "
+                "http://example1.com/foo/ https://example1.com/foo/"},

[amalika, 2016/11/19 18:34:32]

The normalization of a list of CSPSources is not symmetric because we match one
list to another one by one.
For example, in this case if we were to normalized listB to listA the result
would be "https://example1.com/foo/ http://example1.com/foo/".
When we normalized listA to listB, we get repetitions because listB does not
have `http`, we then try to match all `http` source expressions to make sure we
add them. 
We could make an optimization to check whether a certain CSPSource was already
added to avoid adding it again, but not sure if it is necessary?

+               // If exaclty the same policy is specified, it is optimized.
+               {"http: http://example1.com/foo/ https://example1.com/foo/ "
+                "http://example1.com/bar/page.html wss: ws://another.test/bar/",
+                "http: wss: ws://another.test/bar/"}};
+
+  for (const auto& test : cases) {
+    SourceListDirective listB("script-src", test.sources, csp.get());
+    HeapVector<Member<CSPSource>> normalized =
+        listA.getIntersectCSPSources(listB.m_list);
+
+    SourceListDirective helperSourceList("script-src", test.expected,
+                                         csp.get());
+    HeapVector<Member<CSPSource>> expected = helperSourceList.m_list;
+    EXPECT_EQ(normalized.size(), expected.size());
+    for (size_t i = 0; i < expected.size(); i++) {
+      Source a = {expected[i]->m_scheme,       expected[i]->m_host,
+                  expected[i]->m_port,         expected[i]->m_path,
+                  expected[i]->m_hostWildcard, expected[i]->m_portWildcard};
+      Source b = {normalized[i]->m_scheme,       normalized[i]->m_host,
+                  normalized[i]->m_port,         normalized[i]->m_path,
+                  normalized[i]->m_hostWildcard, normalized[i]->m_portWildcard};
+      EXPECT_TRUE(equalSources(a, b));
+    }
+  }
+}
+
 }  // namespace blink