Stop CSP from matching independent scheme/port upgrades

third_party/WebKit/Source/core/frame/csp/CSPSource.h

Index: third_party/WebKit/Source/core/frame/csp/CSPSource.h
diff --git a/third_party/WebKit/Source/core/frame/csp/CSPSource.h b/third_party/WebKit/Source/core/frame/csp/CSPSource.h
index a01b57157a0a6a12722fa0b80a03a780125317b9..100d3799ca9be86fe3c93cb54517c18273396502 100644
--- a/third_party/WebKit/Source/core/frame/csp/CSPSource.h
+++ b/third_party/WebKit/Source/core/frame/csp/CSPSource.h
@@ -22,6 +22,21 @@ class CORE_EXPORT CSPSource : public GarbageCollectedFinalized<CSPSource> {
  public:
   enum WildcardDisposition { NoWildcard, HasWildcard };
 
+  // NotMatching is the only negative member, the rest are different types of
+  // matches. NotMatching should always be 0 to let if statements work nicely
+  enum class PortMatchingResult {
+    NotMatching,
+    MatchingWildcard,
+    MatchingUpgrade,
+    MatchingExact
+  };
+
+  enum class SchemeMatchingResult {
+    NotMatching,
+    MatchingUpgrade,
+    MatchingExact
+  };
+
   CSPSource(ContentSecurityPolicy*,
             const String& scheme,
             const String& host,
@@ -63,13 +78,29 @@ class CORE_EXPORT CSPSource : public GarbageCollectedFinalized<CSPSource> {
   FRIEND_TEST_ALL_PREFIXES(SourceListDirectiveTest, SubsumesWithSelf);
   FRIEND_TEST_ALL_PREFIXES(SourceListDirectiveTest, GetSources);
 
-  bool schemeMatches(const String&) const;
+  SchemeMatchingResult schemeMatches(const String&) const;
   bool hostMatches(const String&) const;
   bool pathMatches(const String&) const;
   // Protocol is necessary to determine default port if it is zero.
-  bool portMatches(int port, const String& protocol) const;
+  PortMatchingResult portMatches(int port, const String& protocol) const;
   bool isSimilar(CSPSource* other) const;
 
+  // Helper inline functions for Port and Scheme MatchingResult enums
+  bool inline requiresUpgrade(const PortMatchingResult result) const {
+    return result == PortMatchingResult::MatchingUpgrade;
+  }
+  bool inline requiresUpgrade(const SchemeMatchingResult result) const {
+    return result == SchemeMatchingResult::MatchingUpgrade;
+  }
+
+  bool inline canUpgrade(const PortMatchingResult result) const {
+    return result == PortMatchingResult::MatchingUpgrade || result == PortMatchingResult::MatchingWildcard;
+  }
+
+  bool inline canUpgrade(const SchemeMatchingResult result) const {
+    return result == SchemeMatchingResult::MatchingUpgrade;
+  }
+
   Member<ContentSecurityPolicy> m_policy;
   String m_scheme;
   String m_host;