CSP: Allow secure upgrade from an explicitly insecure expression.

content/common/content_security_policy/csp_source_list.cc

 // Copyright 2017 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/content_security_policy/csp_context.h"
 
 namespace content {
 
 namespace {
 
@@ skipping 46 matching lines @@
                           CSPContext* context,
                           bool is_redirect) {
   // Wildcards match network schemes ('http', 'https', 'ftp', 'ws', 'wss'), and
   // the scheme of the protected resource:
   // https://w3c.github.io/webappsec-csp/#match-url-to-source-expression. Other
   // schemes, including custom schemes, must be explicitly listed in a source
   // list.
   if (source_list.allow_star) {
     if (url.SchemeIsHTTPOrHTTPS() || url.SchemeIsSuborigin() ||
         url.SchemeIsWSOrWSS() || url.SchemeIs("ftp") ||
-        context->ProtocolMatchesSelf(url))
+        context->ProtocolIsSelf(url))
       return true;
 
     return AllowFromSources(url, source_list.sources, context, is_redirect);
   }
 
   const GURL effective_url = GetEffectiveURL(context, url);
 
   if (source_list.allow_self && context->AllowSelf(effective_url))
     return true;
 
@@ skipping 22 matching lines @@
   }
 
   return text.str();
 }
 
 bool CSPSourceList::IsNone() const {
   return !allow_self && !allow_star && sources.empty();
 }
 
 }  // namespace content