Apply connect-src for link preload with no `as` value

third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicyTest.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/ContentSecurityPolicy.h"
 
 #include "core/dom/Document.h"
 #include "core/fetch/IntegrityMetadata.h"
 #include "core/frame/csp/CSPDirectiveList.h"
 #include "core/html/HTMLScriptElement.h"
@@ skipping 245 matching lines @@
       WebURLRequest::RequestContextEmbed, url, String(), IntegrityMetadataSet(),
       ParserInserted, ResourceRequest::RedirectStatus::NoRedirect,
       ContentSecurityPolicy::SuppressReport));
   EXPECT_TRUE(csp->allowRequest(WebURLRequest::RequestContextPlugin, url,
                                 String(), IntegrityMetadataSet(),
                                 ParserInserted,
                                 ResourceRequest::RedirectStatus::NoRedirect,
                                 ContentSecurityPolicy::SuppressReport));
 }
 
+TEST_F(ContentSecurityPolicyTest, ConnectSrc) {
+  KURL url(KURL(), "https://example.test");
+  csp->bindToExecutionContext(document.get());
+  csp->didReceiveHeader("connect-src 'none';",
+                        ContentSecurityPolicyHeaderTypeEnforce,
+                        ContentSecurityPolicyHeaderSourceMeta);
+  EXPECT_FALSE(csp->allowRequest(WebURLRequest::RequestContextSubresource, url,
+                                 String(), IntegrityMetadataSet(),
+                                 ParserInserted,
+                                 ResourceRequest::RedirectStatus::NoRedirect,
+                                 ContentSecurityPolicy::SuppressReport));
+  EXPECT_FALSE(csp->allowRequest(WebURLRequest::RequestContextXMLHttpRequest,
+                                 url, String(), IntegrityMetadataSet(),
+                                 ParserInserted,
+                                 ResourceRequest::RedirectStatus::NoRedirect,
+                                 ContentSecurityPolicy::SuppressReport));
+  EXPECT_FALSE(csp->allowRequest(WebURLRequest::RequestContextBeacon, url,
+                                 String(), IntegrityMetadataSet(),
+                                 ParserInserted,
+                                 ResourceRequest::RedirectStatus::NoRedirect,
+                                 ContentSecurityPolicy::SuppressReport));
+  EXPECT_FALSE(csp->allowRequest(
+      WebURLRequest::RequestContextFetch, url, String(), IntegrityMetadataSet(),
+      ParserInserted, ResourceRequest::RedirectStatus::NoRedirect,
+      ContentSecurityPolicy::SuppressReport));
+  EXPECT_TRUE(csp->allowRequest(WebURLRequest::RequestContextPlugin, url,
+                                String(), IntegrityMetadataSet(),
+                                ParserInserted,
+                                ResourceRequest::RedirectStatus::NoRedirect,
+                                ContentSecurityPolicy::SuppressReport));
+}
 // Tests that requests for scripts and styles are blocked
 // if `require-sri-for` delivered in HTTP header requires integrity be present
 TEST_F(ContentSecurityPolicyTest, RequireSRIForInHeaderMissingIntegrity) {
   KURL url(KURL(), "https://example.test");
   // Enforce
   Persistent<ContentSecurityPolicy> policy = ContentSecurityPolicy::create();
   policy->bindToExecutionContext(document.get());
   policy->didReceiveHeader("require-sri-for script style",
                            ContentSecurityPolicyHeaderTypeEnforce,
                            ContentSecurityPolicyHeaderSourceHTTP);
@@ skipping 598 matching lines @@
               test.inherits);
 
     response.setHTTPHeaderField(HTTPNames::Allow_CSP_From,
                                 AtomicString("https://example.test"));
     EXPECT_TRUE(ContentSecurityPolicy::shouldEnforceEmbeddersPolicy(
         response, secureOrigin.get()));
   }
 }
 
 }  // namespace blink