Embedding-CSP: Fixing path matching

third_party/WebKit/Source/core/frame/csp/CSPSource.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPSource.h"
 
 #include "core/frame/UseCounter.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "platform/weborigin/KURL.h"
 #include "platform/weborigin/KnownPorts.h"
@@ skipping 56 matching lines @@
       UseCounter::count(*document,
                         UseCounter::CSPSourceWildcardWouldMatchExactHost);
   } else {
     match = equalHosts;
   }
 
   return match;
 }
 
 bool CSPSource::pathMatches(const String& urlPath) const {
-  if (m_path.isEmpty())
+  if (m_path.isEmpty() || (m_path == "/" && urlPath.isEmpty()))

[Mike West, 2016/12/08 08:25:52]

Can you add a test to `CSPSourceTest.cpp`?

     return true;
 
   String path = decodeURLEscapeSequences(urlPath);
 
   if (m_path.endsWith("/"))
     return path.startsWith(m_path);
 
   return path == m_path;
 }
 
@@ skipping 101 matching lines @@
       return false;
   }
   return true;
 }
 
 DEFINE_TRACE(CSPSource) {
   visitor->trace(m_policy);
 }
 
 }  // namespace blink