ContentSecurityPolicy: Fix bug when CSPSource host-part = "*"

third_party/WebKit/Source/core/frame/csp/CSPSource.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPSource.h"
 
 #include "core/frame/UseCounter.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "platform/weborigin/KURL.h"
 #include "platform/weborigin/KnownPorts.h"
@@ skipping 39 matching lines @@
     return protocol == "ws" || protocol == "wss";
   return protocol == m_scheme;
 }
 
 bool CSPSource::hostMatches(const String& host) const {
   Document* document = m_policy->document();
   bool match;
 
   bool equalHosts = m_host == host;
   if (m_hostWildcard == HasWildcard) {
-    match = host.endsWith(String("." + m_host), TextCaseUnicodeInsensitive);
+    if (m_host.isEmpty()) {
+      // host-part = "*"
+      match = true;
+    } else {
+      // host-part = "*." 1*host-char *( "." 1*host-char )
+      match = host.endsWith(String("." + m_host), TextCaseUnicodeInsensitive);
+    }
 
     // Chrome used to, incorrectly, match *.x.y to x.y. This was fixed, but
     // the following count measures when a match fails that would have
     // passed the old, incorrect style, in case a lot of sites were
     // relying on that behavior.
     if (document && equalHosts)
       UseCounter::count(*document,
                         UseCounter::CSPSourceWildcardWouldMatchExactHost);
   } else {
+    // host-part = 1*host-char *( "." 1*host-char )
     match = equalHosts;
   }
 
   return match;
 }
 
 bool CSPSource::pathMatches(const String& urlPath) const {
   if (m_path.isEmpty() || (m_path == "/" && urlPath.isEmpty()))
     return true;
 
@@ skipping 86 matching lines @@
                  : other->m_port;
   WildcardDisposition hostWildcard =
       (m_hostWildcard == HasWildcard) ? other->m_hostWildcard : m_hostWildcard;
   WildcardDisposition portWildcard =
       (m_portWildcard == HasWildcard) ? other->m_portWildcard : m_portWildcard;
   return new CSPSource(m_policy, scheme, host, port, path, hostWildcard,
                        portWildcard);
 }
 
 bool CSPSource::isSchemeOnly() const {
-  return m_host.isEmpty();
+  return m_host.isEmpty() && (m_hostWildcard == NoWildcard);
 }
 
 bool CSPSource::firstSubsumesSecond(
     const HeapVector<Member<CSPSource>>& listA,
     const HeapVector<Member<CSPSource>>& listB) {
   // Empty vector of CSPSources has an effect of 'none'.
   if (!listA.size() || !listB.size())
     return !listB.size();
 
   // Walk through all the items in |listB|, ensuring that each is subsumed by at
   // least one item in |listA|. If any item in |listB| is not subsumed, return
   // false.
   for (const auto& sourceB : listB) {
     bool foundMatch = false;
     for (const auto& sourceA : listA) {
       if ((foundMatch = sourceA->subsumes(sourceB)))
         break;
     }
     if (!foundMatch)
       return false;
   }
   return true;
 }
 
 DEFINE_TRACE(CSPSource) {
   visitor->trace(m_policy);
 }
 
 }  // namespace blink