Embedding-CSP: Ports subsumption

third_party/WebKit/Source/core/frame/csp/CSPSource.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPSource.h"
 
 #include "core/frame/UseCounter.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "platform/weborigin/KURL.h"
 #include "platform/weborigin/KnownPorts.h"
@@ skipping 114 matching lines @@
 }
 
 bool CSPSource::isSimilar(CSPSource* other) const {
   bool schemesMatch =
       schemeMatches(other->m_scheme) || other->schemeMatches(m_scheme);
   if (!schemesMatch || isSchemeOnly() || other->isSchemeOnly())
     return schemesMatch;
   bool hostsMatch = (m_host == other->m_host) || hostMatches(other->m_host) ||
                     other->hostMatches(m_host);
   bool portsMatch = (other->m_portWildcard == HasWildcard) ||
-                    portMatches(other->m_port, other->m_scheme);
+                    portMatches(other->m_port, other->m_scheme) ||
+                    other->portMatches(m_port, m_scheme);
   bool pathsMatch = pathMatches(other->m_path) || other->pathMatches(m_path);
   if (hostsMatch && portsMatch && pathsMatch)
     return true;
 
   return false;
 }
 
 CSPSource* CSPSource::intersect(CSPSource* other) const {
   if (!isSimilar(other))
     return nullptr;
 
   String scheme = other->schemeMatches(m_scheme) ? m_scheme : other->m_scheme;
   if (isSchemeOnly() || other->isSchemeOnly()) {
     const CSPSource* stricter = isSchemeOnly() ? other : this;
     return new CSPSource(m_policy, scheme, stricter->m_host, stricter->m_port,
                          stricter->m_path, stricter->m_hostWildcard,
                          stricter->m_portWildcard);
   }
 
   String host = m_hostWildcard == NoWildcard ? m_host : other->m_host;
   String path = other->pathMatches(m_path) ? m_path : other->m_path;
-  int port = (other->m_portWildcard == HasWildcard || !other->m_port)
+  // Choose this port if the other port is empty, has wildcard or is a port for
+  // a less secure scheme such as "http" whereas scheme of this is "https", in
+  // which case the lengths would differ.
+  int port = (other->m_portWildcard == HasWildcard || !other->m_port ||
+              m_scheme.length() > other->m_scheme.length())
                  ? m_port
                  : other->m_port;
   WildcardDisposition hostWildcard =
       (m_hostWildcard == HasWildcard) ? other->m_hostWildcard : m_hostWildcard;
   WildcardDisposition portWildcard =
       (m_portWildcard == HasWildcard) ? other->m_portWildcard : m_portWildcard;
   return new CSPSource(m_policy, scheme, host, port, path, hostWildcard,
                        portWildcard);
 }
 
@@ skipping 21 matching lines @@
       return false;
   }
   return true;
 }
 
 DEFINE_TRACE(CSPSource) {
   visitor->trace(m_policy);
 }
 
 }  // namespace blink