Disallow an empty host in a CSP host-source directive

Source/core/frame/csp/CSPSourceList.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/frame/csp/CSPSourceList.h"
 
 #include "core/frame/csp/CSPSource.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "platform/ParsingUtilities.h"
@@ skipping 194 matching lines @@
 
         if (position[1] == '/') {
             // scheme://host || scheme://
             //       ^                ^
             if (!parseScheme(begin, position, scheme)
                 || !skipExactly<UChar>(position, end, ':')
                 || !skipExactly<UChar>(position, end, '/')
                 || !skipExactly<UChar>(position, end, '/'))
                 return false;
             if (position == end)
-                return true;
+                return false;
             beginHost = position;
             skipWhile<UChar, isNotColonOrSlash>(position, end);
         }
 
         if (position < end && *position == ':') {
             // host:port || scheme://host:port
             //     ^                     ^
             beginPort = position;
             skipUntil<UChar>(position, end, '/');
         }
@@ skipping 250 matching lines @@
 }
 
 void CSPSourceList::addSourceHash(const ContentSecurityPolicyHashAlgorithm& algorithm, const DigestValue& hash)
 {
     m_hashes.add(CSPHashValue(algorithm, hash));
     m_hashAlgorithmsUsed |= algorithm;
 }
 
 
 } // namespace blink