CSP: Add test: Allow port upgrade without scheme upgrade and vice versa.

third_party/WebKit/Source/core/frame/csp/CSPSourceTest.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPSource.h"
 
 #include "core/dom/Document.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "platform/network/ResourceRequest.h"
 #include "platform/weborigin/KURL.h"
@@ skipping 123 matching lines @@
                    CSPSource::NoWildcard, CSPSource::HasWildcard);
 
   EXPECT_TRUE(source.matches(KURL(base, "http://example.com:8000/")));
   EXPECT_FALSE(source.matches(KURL(base, "http://not-example.com:8000/")));
   EXPECT_TRUE(source.matches(KURL(base, "https://example.com:8000/")));
   EXPECT_FALSE(source.matches(KURL(base, "https://not-example.com:8000/")));
 }
 
 TEST_F(CSPSourceTest, InsecureHostSchemePortMatchesSecurePort) {
   KURL base;
-  CSPSource source(csp.get(), "http", "example.com", 80, "/",
-                   CSPSource::NoWildcard, CSPSource::NoWildcard);
-  EXPECT_TRUE(source.matches(KURL(base, "http://example.com/")));
-  EXPECT_TRUE(source.matches(KURL(base, "http://example.com:80/")));
-  EXPECT_TRUE(source.matches(KURL(base, "http://example.com:443/")));
-  EXPECT_TRUE(source.matches(KURL(base, "https://example.com/")));
-  EXPECT_TRUE(source.matches(KURL(base, "https://example.com:80/")));
-  EXPECT_TRUE(source.matches(KURL(base, "https://example.com:443/")));
 
-  EXPECT_FALSE(source.matches(KURL(base, "http://example.com:8443/")));
-  EXPECT_FALSE(source.matches(KURL(base, "https://example.com:8443/")));
+  // source scheme is "http"
+  {
+    CSPSource source(csp.get(), "http", "example.com", 80, "/",
+                     CSPSource::NoWildcard, CSPSource::NoWildcard);
+    EXPECT_TRUE(source.matches(KURL(base, "http://example.com/")));
+    EXPECT_TRUE(source.matches(KURL(base, "http://example.com:80/")));
+    EXPECT_TRUE(source.matches(KURL(base, "http://example.com:443/")));

[Mike West, 2017/02/15 06:40:02]

Here too. :)

[arthursonzogni, 2017/02/15 12:17:51]

Done. BUG=692499

+    EXPECT_TRUE(source.matches(KURL(base, "https://example.com/")));
+    EXPECT_TRUE(source.matches(KURL(base, "https://example.com:80/")));

[Mike West, 2017/02/15 06:40:02]

Also here.

[arthursonzogni, 2017/02/15 12:17:51]

Done. BUG=692499

+    EXPECT_TRUE(source.matches(KURL(base, "https://example.com:443/")));
 
-  EXPECT_FALSE(source.matches(KURL(base, "http://not-example.com/")));
-  EXPECT_FALSE(source.matches(KURL(base, "http://not-example.com:80/")));
-  EXPECT_FALSE(source.matches(KURL(base, "http://not-example.com:443/")));
-  EXPECT_FALSE(source.matches(KURL(base, "https://not-example.com/")));
-  EXPECT_FALSE(source.matches(KURL(base, "https://not-example.com:80/")));
-  EXPECT_FALSE(source.matches(KURL(base, "https://not-example.com:443/")));
+    EXPECT_FALSE(source.matches(KURL(base, "http://example.com:8443/")));
+    EXPECT_FALSE(source.matches(KURL(base, "https://example.com:8443/")));
+
+    EXPECT_FALSE(source.matches(KURL(base, "http://not-example.com/")));
+    EXPECT_FALSE(source.matches(KURL(base, "http://not-example.com:80/")));
+    EXPECT_FALSE(source.matches(KURL(base, "http://not-example.com:443/")));
+    EXPECT_FALSE(source.matches(KURL(base, "https://not-example.com/")));
+    EXPECT_FALSE(source.matches(KURL(base, "https://not-example.com:80/")));
+    EXPECT_FALSE(source.matches(KURL(base, "https://not-example.com:443/")));
+  }
+
+  // source scheme is empty
+  {
+    Persistent<ContentSecurityPolicy> csp(ContentSecurityPolicy::create());
+    csp->setupSelf(*SecurityOrigin::createFromString("http://example.com"));
+    CSPSource source(csp.get(), "", "example.com", 80, "/",
+                     CSPSource::NoWildcard, CSPSource::NoWildcard);
+    EXPECT_TRUE(source.matches(KURL(base, "http://example.com/")));
+    EXPECT_TRUE(source.matches(KURL(base, "https://example.com:443")));
+    // This is strange, the port is upgraded, even if the scheme is not https.
+    EXPECT_TRUE(source.matches(KURL(base, "http://example.com:443")));

[Mike West, 2017/02/15 06:40:02]

Please file a bug and turn this into a TODO.

[arthursonzogni, 2017/02/15 12:17:51]

Done. BUG=692499

+  }
 }
 
 TEST_F(CSPSourceTest, DoesNotSubsume) {
   struct Source {
     const char* scheme;
     const char* host;
     const char* path;
     const int port;
   };
   struct TestCase {
@@ skipping 608 matching lines @@
     normalized = B->intersect(A);
     Source intersectBA = {
         normalized->m_scheme,       normalized->m_host,
         normalized->m_path,         normalized->m_port,
         normalized->m_hostWildcard, normalized->m_portWildcard};
     EXPECT_TRUE(equalSources(intersectBA, test.normalized));
   }
 }
 
 }  // namespace blink