Part 5.2: Is policy list subsumed under subsuming policy?

third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPDirectiveList.h"
 
 #include "bindings/core/v8/SourceLocation.h"
 #include "core/dom/Document.h"
 #include "core/dom/SecurityContext.h"
 #include "core/dom/SpaceSplitString.h"
@@ skipping 1246 matching lines @@
     // Aggregate all serialized source lists of the returned CSP into a vector
     // based on a directive type, defaulting accordingly (for example, to
     // `default-src`).
     SourceListDirectiveVector returned = getSourceVector(directive, other);
     // TODO(amalika): Add checks for plugin-types, sandbox, disown-opener,
     // navigation-to, worker-src.
     if (!required->subsumes(returned))
       return false;
   }
 
-  return true;
+  if (!m_pluginTypes.get())

[sof, 2016/12/13 13:38:54]

There is an implicit pointer conversion in place for Member<>, so you can avoid
the explicit get() here. Or (!hasPluginTypes())

+    return true;
+
+  HeapVector<Member<MediaListDirective>> pluginTypesOther;
+  for (const auto& policy : other) {
+    if (policy->m_pluginTypes.get())
+      pluginTypesOther.append(policy->m_pluginTypes);
+  }
+
+  return m_pluginTypes->subsumes(pluginTypesOther);

[Mike West, 2016/12/13 13:54:47]

This looks like it's checking the union of all the policies in |other|, rather
than the intersection, which doesn't seem correct. That is, given `type/1 type/2
type/3` and `type/1`, `type/1` should subsume, but it doesn't look like it will.
Is that accurate?

Can you add some tests along those lines so we can verify the behavior?

[amalika, 2016/12/13 14:42:08]

As with `SourceListDirective`, `subsumes` method of MediaListDirective makes
sure to call `getIntersect` inside. So this should not be finding a union.
I will add tests below already added in SubsumesPluginTypes

 }
 
 DEFINE_TRACE(CSPDirectiveList) {
   visitor->trace(m_policy);
   visitor->trace(m_pluginTypes);
   visitor->trace(m_baseURI);
   visitor->trace(m_childSrc);
   visitor->trace(m_connectSrc);
   visitor->trace(m_defaultSrc);
   visitor->trace(m_fontSrc);
   visitor->trace(m_formAction);
   visitor->trace(m_frameAncestors);
   visitor->trace(m_frameSrc);
   visitor->trace(m_imgSrc);
   visitor->trace(m_mediaSrc);
   visitor->trace(m_manifestSrc);
   visitor->trace(m_objectSrc);
   visitor->trace(m_scriptSrc);
   visitor->trace(m_styleSrc);
   visitor->trace(m_workerSrc);
 }
 
 }  // namespace blink