ContentSecurityPolicy: Fix bug when CSPSource host-part = "*"

third_party/WebKit/Source/core/frame/csp/CSPSource.cpp

Index: third_party/WebKit/Source/core/frame/csp/CSPSource.cpp
diff --git a/third_party/WebKit/Source/core/frame/csp/CSPSource.cpp b/third_party/WebKit/Source/core/frame/csp/CSPSource.cpp
index 048ffcf414678e30ab747058100aef57f3019ed6..3b5ed5cce1c5cc84c004ccdbf3283fdcdd77ed51 100644
--- a/third_party/WebKit/Source/core/frame/csp/CSPSource.cpp
+++ b/third_party/WebKit/Source/core/frame/csp/CSPSource.cpp
@@ -57,7 +57,13 @@ bool CSPSource::hostMatches(const String& host) const {
 
   bool equalHosts = m_host == host;
   if (m_hostWildcard == HasWildcard) {
-    match = host.endsWith(String("." + m_host), TextCaseUnicodeInsensitive);
+    if (m_host.isEmpty()) {
+      // host-part = "*"
+      match = true;
+    } else {
+      // host-part = "*." 1*host-char *( "." 1*host-char )
+      match = host.endsWith(String("." + m_host), TextCaseUnicodeInsensitive);
+    }
 
     // Chrome used to, incorrectly, match *.x.y to x.y. This was fixed, but
     // the following count measures when a match fails that would have
@@ -67,6 +73,7 @@ bool CSPSource::hostMatches(const String& host) const {
       UseCounter::count(*document,
                         UseCounter::CSPSourceWildcardWouldMatchExactHost);
   } else {
+    // host-part = 1*host-char *( "." 1*host-char )
     match = equalHosts;
   }
 
@@ -173,7 +180,7 @@ CSPSource* CSPSource::intersect(CSPSource* other) const {
 }
 
 bool CSPSource::isSchemeOnly() const {
-  return m_host.isEmpty();
+  return m_host.isEmpty() && (m_hostWildcard == NoWildcard);
 }
 
 bool CSPSource::firstSubsumesSecond(