Content-Security-Policy: Add tests when source scheme is empty.

third_party/WebKit/Source/core/frame/csp/CSPSourceTest.cpp

Index: third_party/WebKit/Source/core/frame/csp/CSPSourceTest.cpp
diff --git a/third_party/WebKit/Source/core/frame/csp/CSPSourceTest.cpp b/third_party/WebKit/Source/core/frame/csp/CSPSourceTest.cpp
index 5fb8f9373c800ba405f2d7b395dc76b2dd11f347..e004e8945ba9cacc6e9576f2862c2bcd9fb7de09 100644
--- a/third_party/WebKit/Source/core/frame/csp/CSPSourceTest.cpp
+++ b/third_party/WebKit/Source/core/frame/csp/CSPSourceTest.cpp
@@ -139,6 +139,63 @@ TEST_F(CSPSourceTest, InsecureHostSchemeMatchesSecureScheme) {
   EXPECT_FALSE(source.matches(KURL(base, "https://not-example.com:8000/")));
 }
 
+TEST_F(CSPSourceTest, SchemeIsEmpty) {
+  KURL base;
+
+  // Self scheme is http.
+  {
+    Persistent<ContentSecurityPolicy> csp(ContentSecurityPolicy::create());
+    csp->setupSelf(*SecurityOrigin::createFromString("http://a.com/"));
+    CSPSource source(csp.get(), "", "a.com", 0, "/", CSPSource::NoWildcard,
+                     CSPSource::NoWildcard);
+    EXPECT_TRUE(source.matches(KURL(base, "http://a.com")));
+    EXPECT_TRUE(source.matches(KURL(base, "https://a.com")));
+    EXPECT_TRUE(source.matches(KURL(base, "http-so://a.com")));
+    EXPECT_TRUE(source.matches(KURL(base, "https-so://a.com")));
+    EXPECT_FALSE(source.matches(KURL(base, "ftp://a.com")));
+  }
+
+  // Self scheme is https.
+  {
+    Persistent<ContentSecurityPolicy> csp(ContentSecurityPolicy::create());
+    csp->setupSelf(*SecurityOrigin::createFromString("https://a.com/"));
+    CSPSource source(csp.get(), "", "a.com", 0, "/", CSPSource::NoWildcard,
+                     CSPSource::NoWildcard);
+    EXPECT_FALSE(source.matches(KURL(base, "http://a.com")));
+    EXPECT_TRUE(source.matches(KURL(base, "https://a.com")));
+    EXPECT_FALSE(source.matches(KURL(base, "http-so://a.com")));
+    // TODO(mkwst, arthursonzogni): Maybe it should return true.
+    // See http://crbug.com/692442
+    EXPECT_FALSE(source.matches(KURL(base, "https-so://a.com")));
+    EXPECT_FALSE(source.matches(KURL(base, "ftp://a.com")));
+  }
+
+  // Self scheme is not in the http familly.
+  {
+    Persistent<ContentSecurityPolicy> csp(ContentSecurityPolicy::create());
+    csp->setupSelf(*SecurityOrigin::createFromString("ftp://a.com/"));
+    CSPSource source(csp.get(), "", "a.com", 0, "/", CSPSource::NoWildcard,
+                     CSPSource::NoWildcard);
+    EXPECT_FALSE(source.matches(KURL(base, "http://a.com")));
+    EXPECT_TRUE(source.matches(KURL(base, "ftp://a.com")));
+  }
+
+  // Self scheme is unique
+  {
+    Persistent<ContentSecurityPolicy> csp(ContentSecurityPolicy::create());
+    csp->setupSelf(
+        *SecurityOrigin::createFromString("non-standard-scheme://a.com/"));
+    CSPSource source(csp.get(), "", "a.com", 0, "/", CSPSource::NoWildcard,
+                     CSPSource::NoWildcard);
+    // TODO(mkwst, arthursonzogni): This result might be wrong.
+    // See http://crbug.com/692449
+    EXPECT_FALSE(source.matches(KURL(base, "http://a.com")));
+    // TODO(mkwst, arthursonzogni): This result might be wrong.
+    // See http://crbug.com/692449
+    EXPECT_FALSE(source.matches(KURL(base, "non-standard-scheme://a.com")));
+  }
+}
+
 TEST_F(CSPSourceTest, InsecureHostSchemePortMatchesSecurePort) {
   KURL base;
   CSPSource source(csp.get(), "http", "example.com", 80, "/",