Added validation of the policy specified in the 'csp' attribute

third_party/WebKit/Source/core/frame/csp/CSPDirectiveListTest.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPDirectiveList.h"
 
 #include "core/frame/SubresourceIntegrity.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "core/frame/csp/SourceListDirective.h"
 #include "platform/loader/fetch/ResourceRequest.h"
@@ skipping 1122 matching lines @@
         CSPDirectiveList::GetSourceVector(test.directive, policy_vector).size(),
         udpated_total);
     EXPECT_EQ(
         CSPDirectiveList::GetSourceVector(
             ContentSecurityPolicy::DirectiveType::kChildSrc, policy_vector)
             .size(),
         expected_child_src);
   }
 }
 
+TEST_F(CSPDirectiveListTest, IsValidTest) {
+  // Empty string is invalid
+  EXPECT_EQ(CSPDirectiveList::IsValid(""), false);
+
+  // Policy with single directive
+  EXPECT_EQ(CSPDirectiveList::IsValid("base-uri http://example.com"), true);
+  EXPECT_EQ(CSPDirectiveList::IsValid("invalid-policy-name http://example.com"),
+            false);
+
+  // Policy with multiple directives
+  EXPECT_EQ(CSPDirectiveList::IsValid("base-uri http://example.com 'self'; "
+                                      "child-src http://example.com; "
+                                      "default-src http://example.com"),
+            true);
+  EXPECT_EQ(CSPDirectiveList::IsValid("default-src http://example.com; "
+                                      "invalid-policy-name http://example.com"),
+            false);

[Mike West, 2017/05/23 19:21:36]

It would be nice to get a little more coverage here. Can you copy/paste some
items out of
//LayoutTests/http/tests/security/contentSecurityPolicy/source-list-parsing-*.html
to flesh this out with some edge cases?

Ditto for the test we're upstreaming to WPT.

[andypaicu, 2017/05/26 14:41:09]

Done. I'll do the WPT tests separately for now. Raised crbug.com/726724

+}
+
 }  // namespace blink