Content-Security-Policy: Backporting test of hostmatches in CSPSource.

third_party/WebKit/Source/core/frame/csp/CSPSourceTest.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPSource.h"
 
 #include "core/dom/Document.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "platform/network/ResourceRequest.h"
 #include "platform/weborigin/KURL.h"
@@ skipping 143 matching lines @@
   EXPECT_FALSE(source.matches(KURL(base, "https://example.com:8443/")));
 
   EXPECT_FALSE(source.matches(KURL(base, "http://not-example.com/")));
   EXPECT_FALSE(source.matches(KURL(base, "http://not-example.com:80/")));
   EXPECT_FALSE(source.matches(KURL(base, "http://not-example.com:443/")));
   EXPECT_FALSE(source.matches(KURL(base, "https://not-example.com/")));
   EXPECT_FALSE(source.matches(KURL(base, "https://not-example.com:80/")));
   EXPECT_FALSE(source.matches(KURL(base, "https://not-example.com:443/")));
 }
 
+TEST_F(CSPSourceTest, HostMatches) {
+  KURL base;
+  Persistent<ContentSecurityPolicy> csp(ContentSecurityPolicy::create());
+  csp->setupSelf(*SecurityOrigin::createFromString("http://a.com"));
+
+  // Host is * (source-expression = "http://*")
+  {
+    CSPSource source(csp.get(), "http", "", 0, "", CSPSource::HasWildcard,
+                     CSPSource::NoWildcard);
+    EXPECT_TRUE(source.matches(KURL(base, "http://a.com")));
+    EXPECT_TRUE(source.matches(KURL(base, "http://.")));
+  }
+
+  // Host is *.foo.bar
+  {
+    CSPSource source(csp.get(), "", "foo.bar", 0, "", CSPSource::HasWildcard,
+                     CSPSource::NoWildcard);
+    EXPECT_FALSE(source.matches(KURL(base, "http://a.com")));
+    EXPECT_FALSE(source.matches(KURL(base, "http://bar")));
+    EXPECT_FALSE(source.matches(KURL(base, "http://foo.bar")));
+    EXPECT_FALSE(source.matches(KURL(base, "http://o.bar")));
+    EXPECT_TRUE(source.matches(KURL(base, "http://*.foo.bar")));

[arthursonzogni, 2017/02/14 14:16:30]

It is strange to me(A wildcard in the host name), but why not.

[Mike West, 2017/02/15 06:43:49]

This should match. It gets canonicalized to something like `%2A.foo.bar`, which
matches `foo.bar` with a host wildcard.

[arthursonzogni, 2017/02/15 12:47:59]

Acknowledged.

+    EXPECT_TRUE(source.matches(KURL(base, "http://sub.foo.bar")));
+    EXPECT_TRUE(source.matches(KURL(base, "http://sub.sub.foo.bar")));
+    EXPECT_TRUE(source.matches(KURL(base, "http://.foo.bar")));

[arthursonzogni, 2017/02/14 14:16:30]

You said it looks strange to you. What do you think should be done?

[Mike West, 2017/02/15 06:43:49]

I did say that this looks strange. Please file a bug... I don't think it's a big
deal, as we apparently transparently rewrite `.example.com` to `example.com` for
navigations, but it's strange regardless.

[arthursonzogni, 2017/02/15 12:47:59]

Done. BUG=692505

+  }
+
+  // Host is exact.
+  {
+    CSPSource source(csp.get(), "", "foo.bar", 0, "", CSPSource::NoWildcard,
+                     CSPSource::NoWildcard);
+    EXPECT_TRUE(source.matches(KURL(base, "http://foo.bar")));
+    EXPECT_FALSE(source.matches(KURL(base, "http://sub.foo.bar")));
+    EXPECT_FALSE(source.matches(KURL(base, "http://bar")));
+    EXPECT_FALSE(source.matches(KURL(base, "http://.foo.bar")));

[arthursonzogni, 2017/02/14 14:16:30]

Same here.

[Mike West, 2017/02/15 06:43:49]

Ditto.

[arthursonzogni, 2017/02/15 12:47:59]

Done.

+  }
+}
+
 TEST_F(CSPSourceTest, DoesNotSubsume) {
   struct Source {
     const char* scheme;
     const char* host;
     const char* path;
     const int port;
   };
   struct TestCase {
     const Source a;
     const Source b;
@@ skipping 606 matching lines @@
     normalized = B->intersect(A);
     Source intersectBA = {
         normalized->m_scheme,       normalized->m_host,
         normalized->m_path,         normalized->m_port,
         normalized->m_hostWildcard, normalized->m_portWildcard};
     EXPECT_TRUE(equalSources(intersectBA, test.normalized));
   }
 }
 
 }  // namespace blink