Part 3.2: Is policy list subsumed under subsuming policy?

third_party/WebKit/Source/core/frame/csp/SourceListDirective.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/SourceListDirective.h"
 
 #include "core/frame/csp/CSPSource.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "platform/network/ContentSecurityPolicyParsers.h"
 #include "platform/weborigin/KURL.h"
@@ skipping 567 matching lines @@
 
   return false;
 }
 
 bool SourceListDirective::subsumes(
     HeapVector<Member<SourceListDirective>> other) {
   // TODO(amalika): Handle here special keywords.
   if (!m_list.size() || !other.size())
     return !m_list.size();
 
-  HeapVector<Member<CSPSource>> normalizedA = other[0]->m_list;
-  for (size_t i = 1; i < other.size(); i++) {
-    normalizedA = other[i]->getIntersectCSPSources(normalizedA);
-  }
+  HeapVector<Member<CSPSource>> normalizedA = m_list;
+  if (m_allowSelf && other[0]->m_policy->getSelfSource())
+    normalizedA.append(other[0]->m_policy->getSelfSource());

[amalika, 2016/11/30 10:37:23]

This way, we do not even have to set 'self' on Embedding-CSP.

 
-  return CSPSource::firstSubsumesSecond(m_list, normalizedA);
+  HeapVector<Member<CSPSource>> normalizedB = other[0]->m_list;
+  if (other[0]->m_allowSelf && other[0]->m_policy->getSelfSource())
+    normalizedB.append(other[0]->m_policy->getSelfSource());
+  for (size_t i = 1; i < other.size(); i++)
+    normalizedB = other[i]->getIntersectCSPSources(normalizedB);
+
+  return CSPSource::firstSubsumesSecond(normalizedA, normalizedB);
 }
 
 HashMap<String, CSPSource*> SourceListDirective::getIntersectSchemesOnly(
     HeapVector<Member<CSPSource>> other) {
   HashMap<String, CSPSource*> schemesA;
   for (const auto& sourceA : m_list) {
     if (sourceA->isSchemeOnly())
       addSourceToMap(schemesA, sourceA);
   }
   // Add schemes only sources if they are present in both `this` and `other`,
@@ skipping 19 matching lines @@
   HeapVector<Member<CSPSource>> normalized;
   // Add all normalized scheme source expressions.
   for (auto it = schemesMap.begin(); it != schemesMap.end(); ++it) {
     // We do not add secure versions if insecure schemes are present.
     if ((it->key != "https" || !schemesMap.contains("http")) &&
         (it->key != "wss" || !schemesMap.contains("ws"))) {
       normalized.append(it->value);
     }
   }
 
-  for (const auto& sourceA : m_list) {
+  HeapVector<Member<CSPSource>> thisVector = m_list;
+  if (m_allowSelf)
+    thisVector.append(m_policy->getSelfSource());
+  for (const auto& sourceA : thisVector) {
     if (schemesMap.contains(sourceA->getScheme()))
       continue;
 
     CSPSource* match(nullptr);
     for (const auto& sourceB : other) {
       // No need to add a host source expression if it is subsumed by the
       // matching scheme source expression.
       if (schemesMap.contains(sourceB->getScheme()))
         continue;
       // If sourceA is scheme only but there was no intersection for it in the
@@ skipping 16 matching lines @@
   return normalized;
 }
 
 DEFINE_TRACE(SourceListDirective) {
   visitor->trace(m_policy);
   visitor->trace(m_list);
   CSPDirective::trace(visitor);
 }
 
 }  // namespace blink