CSP: Change 'self' to ask the policy object whether a URL matches.

Source/core/frame/csp/ContentSecurityPolicy.cpp

 /*
  * Copyright (C) 2011 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 119 matching lines @@
         return ReferrerPolicyNever;
     return a;
 }
 
 ContentSecurityPolicy::ContentSecurityPolicy(ExecutionContext* executionContext)
     : m_executionContext(executionContext)
     , m_overrideInlineStyleAllowed(false)
     , m_scriptHashAlgorithmsUsed(ContentSecurityPolicyHashAlgorithmNone)
     , m_styleHashAlgorithmsUsed(ContentSecurityPolicyHashAlgorithmNone)
 {
+    m_selfSource = adoptPtr(new CSPSource(this, securityOrigin()->protocol(), securityOrigin()->host(), securityOrigin()->port(), String(), false, false));
 }
 
 ContentSecurityPolicy::~ContentSecurityPolicy()
 {
 }
 
 Document* ContentSecurityPolicy::document() const
 {
     return m_executionContext->isDocument() ? toDocument(m_executionContext) : 0;
 }
@@ skipping 615 matching lines @@
 void ContentSecurityPolicy::reportBlockedScriptExecutionToInspector(const String& directiveText) const
 {
     m_executionContext->reportBlockedScriptExecutionToInspector(directiveText);
 }
 
 bool ContentSecurityPolicy::experimentalFeaturesEnabled() const
 {
     return RuntimeEnabledFeatures::experimentalContentSecurityPolicyFeaturesEnabled();
 }
 
+bool ContentSecurityPolicy::urlMatchesSelf(const KURL& url) const
+{
+    return m_selfSource->matches(url);
+}
+
+bool ContentSecurityPolicy::protocolMatchesSelf(const KURL& url) const
+{
+    String protectedResourceScheme(securityOrigin()->protocol());
+    if (equalIgnoringCase("http", protectedResourceScheme))
+        return url.protocolIs("http") || url.protocolIs("https");

[jochen (gone - plz use gerrit), 2014/09/09 08:11:14]

isn't there some protocolIsInHTTPFamily() method?

+    return equalIgnoringCase(url.protocol(), protectedResourceScheme);
+}
+
 bool ContentSecurityPolicy::shouldBypassMainWorld(ExecutionContext* context)
 {
     if (context && context->isDocument()) {
         Document* document = toDocument(context);
         if (document->frame())
             return document->frame()->script().shouldBypassMainWorldCSP();
     }
     return false;
 }
 
 bool ContentSecurityPolicy::shouldSendViolationReport(const String& report) const
 {
     // Collisions have no security impact, so we can save space by storing only the string's hash rather than the whole report.
     return !m_violationReportsSent.contains(report.impl()->hash());
 }
 
 void ContentSecurityPolicy::didSendViolationReport(const String& report)
 {
     m_violationReportsSent.add(report.impl()->hash());
 }
 
 } // namespace blink