Part 4.1: Is policy list subsumed under subsuming policy?

third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicy.cpp

 /*
  * Copyright (C) 2011 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 1538 matching lines @@
     const String& report) const {
   // Collisions have no security impact, so we can save space by storing only
   // the string's hash rather than the whole report.
   return !m_violationReportsSent.contains(report.impl()->hash());
 }
 
 void ContentSecurityPolicy::didSendViolationReport(const String& report) {
   m_violationReportsSent.add(report.impl()->hash());
 }
 
+bool ContentSecurityPolicy::subsumes(const ContentSecurityPolicy& other) {
+  if (!m_policies.size() || !other.m_policies.size())
+    return !m_policies.size();
+
+  CSPDirectiveListVector otherVector;
+  for (const auto& policy : other.m_policies) {
+    if (!policy->isReportOnly())
+      otherVector.append(policy);
+  }
+  // Embedding-CSP specifies only one policy.
+  DCHECK(m_policies.size(), 1u);

[amalika, 2016/11/28 11:56:22]

Since Embedding-CSP can't be more than just one policy, should this be removed?

[Mike West, 2016/11/28 13:08:02]

I'd suggest returning `false` if more than one policy is present.

[amalika, 2016/11/29 12:43:52]

Changed!

+
+  return m_policies[0]->subsumes(otherVector);

[Mike West, 2016/11/28 13:08:02]

What if `m_policies[0]` is report-only?

[amalika, 2016/11/29 12:43:52]

Current implementation of Embedding-CSP is such that there is only one string
which becomes one enforced policy. We set it to be of type `Enforce` in
DocumentLoader.
Would there be any other usages of subsumption that we should check `Report`
type here?

+}
+
 }  // namespace blink