Embedding-CSP: Ports subsumption

third_party/WebKit/Source/core/frame/csp/CSPSource.cpp

Index: third_party/WebKit/Source/core/frame/csp/CSPSource.cpp
diff --git a/third_party/WebKit/Source/core/frame/csp/CSPSource.cpp b/third_party/WebKit/Source/core/frame/csp/CSPSource.cpp
index badd121b42fb58f00ff9b7a6fb6336432a1d05e9..ac513c991c67ff0b5dd89c54ecfbcd13a5795223 100644
--- a/third_party/WebKit/Source/core/frame/csp/CSPSource.cpp
+++ b/third_party/WebKit/Source/core/frame/csp/CSPSource.cpp
@@ -132,7 +132,8 @@ bool CSPSource::isSimilar(CSPSource* other) {
   bool hostsMatch = (m_host == other->m_host) || hostMatches(other->m_host) ||
                     other->hostMatches(m_host);
   bool portsMatch = (other->m_portWildcard == HasWildcard) ||
-                    portMatches(other->m_port, other->m_scheme);
+                    portMatches(other->m_port, other->m_scheme) ||
+                    other->portMatches(m_port, m_scheme);
   bool pathsMatch = pathMatches(other->m_path) || other->pathMatches(m_path);
   if (hostsMatch && portsMatch && pathsMatch)
     return true;
@@ -154,7 +155,8 @@ CSPSource* CSPSource::intersect(CSPSource* other) {
 
   String host = m_hostWildcard == NoWildcard ? m_host : other->m_host;
   String path = other->pathMatches(m_path) ? m_path : other->m_path;
-  int port = (other->m_portWildcard == HasWildcard || !other->m_port)
+  int port = (other->m_portWildcard == HasWildcard || !other->m_port ||
+              m_scheme.length() > other->m_scheme.length())

[amalika, 2016/12/06 09:29:13]

By this point, we know that A and B are similar, i.e. their schemes match. The
only case when one length could be greater than the other is if it is more
secure. So we want to pick that port.

[Mike West, 2016/12/06 13:41:09]

Can you spell this out, please? Reading `http` and `https` (or `ws` and `wss`)
is more verbose, but will be much clearer in a year when I've forgotten all
about the rationale for the length check here. :)

                  ? m_port
                  : other->m_port;
   WildcardDisposition hostWildcard =