Part 4.1: Is policy list subsumed under subsuming policy?

third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicyTest.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/ContentSecurityPolicy.h"
 
 #include "core/dom/Document.h"
 #include "core/fetch/IntegrityMetadata.h"
 #include "core/frame/csp/CSPDirectiveList.h"
 #include "core/html/HTMLScriptElement.h"
@@ skipping 893 matching lines @@
                   response, secureOrigin.get()),
               test.inherits);
 
     response.setHTTPHeaderField(HTTPNames::Allow_CSP_From,
                                 AtomicString("https://example.test"));
     EXPECT_TRUE(ContentSecurityPolicy::shouldEnforceEmbeddersPolicy(
         response, secureOrigin.get()));
   }
 }
 
+TEST_F(ContentSecurityPolicyTest, Subsumes) {

[amalika, 2016/11/28 11:56:22]

Since we test subsumption on other levels + layout tests,
this test mainly checks the ContentSecurityPolicyHeaderType and multiplicity of
the returned CSP.

+  ContentSecurityPolicy* other = ContentSecurityPolicy::create();
+  EXPECT_TRUE(csp->subsumes(*other));
+  EXPECT_TRUE(other->subsumes(*csp));
+
+  csp->didReceiveHeader("default-src http://example.com;",
+                        ContentSecurityPolicyHeaderTypeEnforce,
+                        ContentSecurityPolicyHeaderSourceHTTP);
+  // If this CSP is not empty, the other must not be empty either.
+  EXPECT_FALSE(csp->subsumes(*other));
+  EXPECT_TRUE(other->subsumes(*csp));
+
+  // Report-only policies do not impact subsumption.
+  other->didReceiveHeader("default-src http://example.com;",
+                          ContentSecurityPolicyHeaderTypeReport,
+                          ContentSecurityPolicyHeaderSourceHTTP);
+  EXPECT_FALSE(csp->subsumes(*other));
+
+  // CSPDirectiveLists have to subsume.
+  other->didReceiveHeader("default-src http://example.com https://another.com;",
+                          ContentSecurityPolicyHeaderTypeEnforce,
+                          ContentSecurityPolicyHeaderSourceHTTP);
+  EXPECT_FALSE(csp->subsumes(*other));
+
+  // `other` is stricter than `this`.
+  other->didReceiveHeader("default-src https://example.com;",
+                          ContentSecurityPolicyHeaderTypeEnforce,
+                          ContentSecurityPolicyHeaderSourceHTTP);
+  EXPECT_TRUE(csp->subsumes(*other));
+}
+
 }  // namespace blink