Part 5.2: Is policy list subsumed under subsuming policy?

third_party/WebKit/Source/core/frame/csp/CSPDirectiveListTest.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPDirectiveList.h"
 
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "core/frame/csp/SourceListDirective.h"
 #include "platform/network/ContentSecurityPolicyParsers.h"
 #include "platform/network/ResourceRequest.h"
@@ skipping 603 matching lines @@
         createList(test.policyA, ContentSecurityPolicyHeaderTypeEnforce);
 
     HeapVector<Member<CSPDirectiveList>> listB;
     for (const auto& policyB : test.policiesB)
       listB.append(createList(policyB, ContentSecurityPolicyHeaderTypeEnforce));
 
     EXPECT_EQ(test.expected, A->subsumes(listB));
   }
 }
 
+TEST_F(CSPDirectiveListTest, SubsumesPluginTypes) {
+  struct TestCase {
+    const char* policyA;
+    const std::vector<const char*> policiesB;
+    bool expected;
+  } cases[] = {
+      // `policyA` subsumes `policiesB`.
+      {"script-src 'unsafe-inline'",
+       {"script-src  ", "script-src http://example.com",
+        "plugin-types text/plain"},
+       true},
+      {"script-src http://example.com",
+       {"script-src http://example.com; plugin-types "},
+       true},
+      {"script-src http://example.com",
+       {"script-src http://example.com; plugin-types text/plain"},
+       true},
+      {"script-src http://example.com; plugin-types text/plain",
+       {"script-src http://example.com; plugin-types text/plain"},
+       true},
+      {"script-src http://example.com; plugin-types text/plain",
+       {"script-src http://example.com; plugin-types "},
+       true},
+      {"script-src http://example.com; plugin-types text/plain",
+       {"script-src http://example.com; plugin-types ", "plugin-types "},
+       true},
+      // `policyA` does not subsume `policiesB`.
+      {"script-src http://example.com; plugin-types text/plain",
+       {"script-src http://example.com"},
+       false},
+      {"plugin-types random-value",
+       {"script-src 'unsafe-inline'", "plugin-types text/plain"},
+       false},
+      {"plugin-types random-value",
+       {"script-src http://example.com", "script-srcs http://example.com"},

[Mike West, 2016/12/13 13:54:47]

Is `script-srcs` intentional?

+       false},
+      {"plugin-types random-value",
+       {"plugin-types  text/plain", "plugin-types text/plain"},
+       false},
+      {"script-src http://example.com; plugin-types text/plain",
+       {"plugin-types ", "plugin-types "},
+       false},
+  };
+
+  for (const auto& test : cases) {
+    CSPDirectiveList* A =
+        createList(test.policyA, ContentSecurityPolicyHeaderTypeEnforce);
+
+    HeapVector<Member<CSPDirectiveList>> listB;
+    for (const auto& policyB : test.policiesB)
+      listB.append(createList(policyB, ContentSecurityPolicyHeaderTypeEnforce));
+
+    EXPECT_EQ(test.expected, A->subsumes(listB));
+  }
+}
+
 TEST_F(CSPDirectiveListTest, OperativeDirectiveGivenType) {
   enum DefaultBehaviour { Default, NoDefault, ChildAndDefault };
 
   struct TestCase {
     ContentSecurityPolicy::DirectiveType directive;
     const DefaultBehaviour type;
   } cases[] = {
       // Directives with default directive.
       {ContentSecurityPolicy::DirectiveType::ChildSrc, Default},
       {ContentSecurityPolicy::DirectiveType::ConnectSrc, Default},
@@ skipping 223 matching lines @@
         CSPDirectiveList::getSourceVector(test.directive, policyVector).size(),
         udpatedTotal);
     EXPECT_EQ(CSPDirectiveList::getSourceVector(
                   ContentSecurityPolicy::DirectiveType::ChildSrc, policyVector)
                   .size(),
               expectedChildSrc);
   }
 }
 
 }  // namespace blink