Content-Security-Policy: Add test with 'filesystem' and 'blob'.

third_party/WebKit/Source/core/frame/csp/SourceListDirectiveTest.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/SourceListDirective.h"
 
 #include "core/dom/Document.h"
 #include "core/frame/csp/CSPSource.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "platform/network/ResourceRequest.h"
@@ skipping 136 matching lines @@
   SchemeRegistry::registerURLSchemeAsBypassingContentSecurityPolicy("https");
 
   EXPECT_TRUE(sourceList.allows(KURL(base, "https://example.test/")));
   EXPECT_TRUE(sourceList.allows(KURL(base, "blob:https://example.test/")));
 
   // Unregister the scheme to clean up after ourselves.
   SchemeRegistry::removeURLSchemeRegisteredAsBypassingContentSecurityPolicy(
       "https");
 }
 
+TEST_F(SourceListDirectiveTest, FilesystemMatchingSelf) {
+  KURL base;
+  String sources = "'self'";
+  SourceListDirective sourceList("script-src", sources, csp.get());
+
+  EXPECT_TRUE(sourceList.allows(KURL(base, "https://example.test/")));
+  EXPECT_FALSE(sourceList.allows(
+      KURL(base, "filesystem:https://example.test/file.txt")));
+
+  // Register "https" as bypassing CSP, which should trigger the innerURL
+  // behavior.
+  SchemeRegistry::registerURLSchemeAsBypassingContentSecurityPolicy("https");
+
+  EXPECT_TRUE(sourceList.allows(KURL(base, "https://example.test/")));
+  EXPECT_TRUE(sourceList.allows(
+      KURL(base, "filesystem:https://example.test/file.txt")));
+
+  // Unregister the scheme to clean up after ourselves.
+  SchemeRegistry::removeURLSchemeRegisteredAsBypassingContentSecurityPolicy(
+      "https");
+}
+
+TEST_F(SourceListDirectiveTest, BlobDisallowedWhenBypassingSelfScheme) {
+  KURL base;
+  String sources = "'self' blob:";
+  SourceListDirective sourceList("script-src", sources, csp.get());
+
+  EXPECT_TRUE(sourceList.allows(
+      KURL(base, "blob:https://example.test/1be95204-93d6-4GUID")));
+  EXPECT_TRUE(sourceList.allows(
+      KURL(base, "blob:https://not-example.test/1be95204-93d6-4GUID")));
+
+  // Register "https" as bypassing CSP, which should trigger the innerURL
+  // behavior.
+  SchemeRegistry::registerURLSchemeAsBypassingContentSecurityPolicy("https");
+
+  EXPECT_TRUE(sourceList.allows(
+      KURL(base, "blob:https://example.test/1be95204-93d6-4GUID")));
+  // TODO(mkwst, arthursonzogni): This should be true.
+  // See http://crbug.com/692046
+  EXPECT_FALSE(sourceList.allows(
+      KURL(base, "blob:https://not-example.test/1be95204-93d6-4GUID")));
+
+  // Unregister the scheme to clean up after ourselves.
+  SchemeRegistry::removeURLSchemeRegisteredAsBypassingContentSecurityPolicy(
+      "https");
+}
+
+TEST_F(SourceListDirectiveTest, FilesystemDisallowedWhenBypassingSelfScheme) {
+  KURL base;
+  String sources = "'self' filesystem:";
+  SourceListDirective sourceList("script-src", sources, csp.get());
+
+  EXPECT_TRUE(sourceList.allows(
+      KURL(base, "filesystem:https://example.test/file.txt")));
+  EXPECT_TRUE(sourceList.allows(
+      KURL(base, "filesystem:https://not-example.test/file.txt")));
+
+  // Register "https" as bypassing CSP, which should trigger the innerURL
+  // behavior.
+  SchemeRegistry::registerURLSchemeAsBypassingContentSecurityPolicy("https");
+
+  EXPECT_TRUE(sourceList.allows(
+      KURL(base, "filesystem:https://example.test/file.txt")));
+  // TODO(mkwst, arthursonzogni): This should be true.
+  // See http://crbug.com/692046
+  EXPECT_FALSE(sourceList.allows(
+      KURL(base, "filesystem:https://not-example.test/file.txt")));
+
+  // Unregister the scheme to clean up after ourselves.
+  SchemeRegistry::removeURLSchemeRegisteredAsBypassingContentSecurityPolicy(
+      "https");
+}
+
 TEST_F(SourceListDirectiveTest, BlobMatchingBlob) {
   KURL base;
   String sources = "blob:";
   SourceListDirective sourceList("script-src", sources, csp.get());
 
   EXPECT_FALSE(sourceList.allows(KURL(base, "https://example.test/")));
   EXPECT_TRUE(sourceList.allows(KURL(base, "blob:https://example.test/")));
 }
 
 TEST_F(SourceListDirectiveTest, BasicMatching) {
@@ skipping 1226 matching lines @@
   // When the host-part is "*" and the expression-source is not "*", then every
   // host are allowed. See crbug.com/682673.
   {
     String sources = "http://*";
     SourceListDirective sourceList("default-src", sources, csp.get());
     EXPECT_TRUE(sourceList.allows(KURL(base, "http://a.com")));
   }
 }
 
 }  // namespace blink