Stop CSP from matching independent scheme/port upgrades

third_party/WebKit/Source/core/frame/csp/CSPSourceTest.cpp

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPSource.h"
 
 #include "core/dom/Document.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "platform/network/ResourceRequest.h"
 #include "platform/weborigin/KURL.h"
@@ skipping 87 matching lines @@
   KURL base;
   CSPSource source(csp.get(), "http", "example.com", 8000, "/bar/",
                    CSPSource::NoWildcard, CSPSource::NoWildcard);
 
   EXPECT_TRUE(
       source.matches(KURL(base, "http://example.com:8000/"),
                      ResourceRequest::RedirectStatus::FollowedRedirect));
   EXPECT_TRUE(
       source.matches(KURL(base, "http://example.com:8000/foo"),
                      ResourceRequest::RedirectStatus::FollowedRedirect));
-  EXPECT_TRUE(
+  // Should not allow upgrade of port or scheme without upgrading both
+  EXPECT_FALSE(
       source.matches(KURL(base, "https://example.com:8000/foo"),
                      ResourceRequest::RedirectStatus::FollowedRedirect));
-
   EXPECT_FALSE(
       source.matches(KURL(base, "http://not-example.com:8000/foo"),
                      ResourceRequest::RedirectStatus::FollowedRedirect));
   EXPECT_FALSE(source.matches(KURL(base, "http://example.com:9000/foo/"),
                               ResourceRequest::RedirectStatus::NoRedirect));
 }
 
 TEST_F(CSPSourceTest, InsecureSchemeMatchesSecureScheme) {
   KURL base;
   CSPSource source(csp.get(), "http", "", 0, "/", CSPSource::NoWildcard,
                    CSPSource::HasWildcard);
 
   EXPECT_TRUE(source.matches(KURL(base, "http://example.com:8000/")));
   EXPECT_TRUE(source.matches(KURL(base, "https://example.com:8000/")));
   EXPECT_TRUE(source.matches(KURL(base, "http://not-example.com:8000/")));
   EXPECT_TRUE(source.matches(KURL(base, "https://not-example.com:8000/")));
   EXPECT_FALSE(source.matches(KURL(base, "ftp://example.com:8000/")));
 }
 
 TEST_F(CSPSourceTest, InsecureHostSchemeMatchesSecureScheme) {
   KURL base;
   CSPSource source(csp.get(), "http", "example.com", 0, "/",
                    CSPSource::NoWildcard, CSPSource::HasWildcard);
 
   EXPECT_TRUE(source.matches(KURL(base, "http://example.com:8000/")));
   EXPECT_FALSE(source.matches(KURL(base, "http://not-example.com:8000/")));
-  EXPECT_TRUE(source.matches(KURL(base, "https://example.com:8000/")));
+  EXPECT_FALSE(source.matches(KURL(base, "https://example.com:8000/")));
   EXPECT_FALSE(source.matches(KURL(base, "https://not-example.com:8000/")));
 }
 
 TEST_F(CSPSourceTest, SchemeIsEmpty) {
   KURL base;
 
   // Self scheme is http.
   {
     Persistent<ContentSecurityPolicy> csp(ContentSecurityPolicy::create());
     csp->setupSelf(*SecurityOrigin::createFromString("http://a.com/"));
@@ skipping 49 matching lines @@
 
 TEST_F(CSPSourceTest, InsecureHostSchemePortMatchesSecurePort) {
   KURL base;
 
   // source scheme is "http"
   {
     CSPSource source(csp.get(), "http", "example.com", 80, "/",
                      CSPSource::NoWildcard, CSPSource::NoWildcard);
     EXPECT_TRUE(source.matches(KURL(base, "http://example.com/")));
     EXPECT_TRUE(source.matches(KURL(base, "http://example.com:80/")));
-    // TODO(mkwst, arthursonzogni): It is weird to upgrade the port without the
-    // sheme. See http://crbug.com/692499
-    EXPECT_TRUE(source.matches(KURL(base, "http://example.com:443/")));
+
+    // Should not allow scheme upgrades unless both port and scheme are upgraded
+    EXPECT_FALSE(source.matches(KURL(base, "http://example.com:443/")));
     EXPECT_TRUE(source.matches(KURL(base, "https://example.com/")));
-    // TODO(mkwst, arthursonzogni): It is weird to upgrade the scheme without
-    // the port. See http://crbug.com/692499
-    EXPECT_TRUE(source.matches(KURL(base, "https://example.com:80/")));
+    EXPECT_FALSE(source.matches(KURL(base, "https://example.com:80/")));
+
     EXPECT_TRUE(source.matches(KURL(base, "https://example.com:443/")));
 
     EXPECT_FALSE(source.matches(KURL(base, "http://example.com:8443/")));
     EXPECT_FALSE(source.matches(KURL(base, "https://example.com:8443/")));
 
     EXPECT_FALSE(source.matches(KURL(base, "http://not-example.com/")));
     EXPECT_FALSE(source.matches(KURL(base, "http://not-example.com:80/")));
     EXPECT_FALSE(source.matches(KURL(base, "http://not-example.com:443/")));
     EXPECT_FALSE(source.matches(KURL(base, "https://not-example.com/")));
     EXPECT_FALSE(source.matches(KURL(base, "https://not-example.com:80/")));
     EXPECT_FALSE(source.matches(KURL(base, "https://not-example.com:443/")));
   }
 
   // source scheme is empty
   {
     Persistent<ContentSecurityPolicy> csp(ContentSecurityPolicy::create());
     csp->setupSelf(*SecurityOrigin::createFromString("http://example.com"));
     CSPSource source(csp.get(), "", "example.com", 80, "/",
                      CSPSource::NoWildcard, CSPSource::NoWildcard);
     EXPECT_TRUE(source.matches(KURL(base, "http://example.com/")));
     EXPECT_TRUE(source.matches(KURL(base, "https://example.com:443")));
-    // TODO(mkwst, arthursonzogni): It is weird to upgrade the port without the
-    // sheme. See http://crbug.com/692499
-    EXPECT_TRUE(source.matches(KURL(base, "http://example.com:443")));
+    // Should not allow upgrade of port or scheme without upgrading both
+    EXPECT_FALSE(source.matches(KURL(base, "http://example.com:443")));
+  }
+
+  // source port is empty
+  {
+    CSPSource source(csp.get(), "http", "example.com", 0, "/",
+                     CSPSource::NoWildcard, CSPSource::NoWildcard);
+
+    EXPECT_TRUE(source.matches(KURL(base, "http://example.com")));
+    EXPECT_TRUE(source.matches(KURL(base, "https://example.com")));
+    EXPECT_TRUE(source.matches(KURL(base, "https://example.com:443")));
+    // Should not allow upgrade of port or scheme without upgrading both
+    EXPECT_FALSE(source.matches(KURL(base, "https://example.com:80")));
+    EXPECT_FALSE(source.matches(KURL(base, "http://example.com:443")));
   }
 }
 
 TEST_F(CSPSourceTest, HostMatches) {
   KURL base;
   Persistent<ContentSecurityPolicy> csp(ContentSecurityPolicy::create());
   csp->setupSelf(*SecurityOrigin::createFromString("http://a.com"));
 
   // Host is * (source-expression = "http://*")
   {
@@ skipping 649 matching lines @@
     normalized = B->intersect(A);
     Source intersectBA = {
         normalized->m_scheme,       normalized->m_host,
         normalized->m_path,         normalized->m_port,
         normalized->m_hostWildcard, normalized->m_portWildcard};
     EXPECT_TRUE(equalSources(intersectBA, test.normalized));
   }
 }
 
 }  // namespace blink