CSP 'self' is not interpreted correctly for iframes,

Source/core/frame/csp/ContentSecurityPolicy.cpp

 /*
  * Copyright (C) 2011 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 137 matching lines @@
 
 void ContentSecurityPolicy::bindToExecutionContext(ExecutionContext* executionContext)
 {
     m_executionContext = executionContext;
     applyPolicySideEffectsToExecutionContext();
 }
 
 void ContentSecurityPolicy::applyPolicySideEffectsToExecutionContext()
 {
     ASSERT(m_executionContext);
-    // Ensure that 'self' processes correctly.
-    m_selfProtocol = securityOrigin()->protocol();
-    m_selfSource = adoptPtr(new CSPSource(this, m_selfProtocol, securityOrigin()->host(), securityOrigin()->port(), String(), CSPSource::NoWildcard, CSPSource::NoWildcard));
+    // Ensure that 'self' processes correctly. Note that this uses the URL of
+    // the context, not the security origin. That's because in the sandbox
+    // case, the origin is 'unique' (which, in practice, gives an empty scheme,
+    // host, and port). However, regarding matching the 'self' source, the CSP
+    // spec
+    // (https://w3c.github.io/webappsec/specs/content-security-policy/#match-source-expression)
+    // reads: "Return does match if the URL has the same scheme, host, and port
+    // as the protected resource’s URL". Thus, if Chrome were to store the
+    // 'unqiue' origin in m_selfSource, it would match nothing, even though it
+    // should match resources that are loaded at the same URL it loaded from.
+    m_selfProtocol = m_executionContext->url().protocol();
+    m_selfSource = adoptPtr(new CSPSource(this, m_selfProtocol, m_executionContext->url().host(), m_executionContext->url().port(), String(), CSPSource::NoWildcard, CSPSource::NoWildcard));
 
     // If we're in a Document, set the referrer policy, mixed content checking, and sandbox
     // flags, then dump all the parsing error messages, then poke at histograms.
     if (Document* document = this->document()) {
         document->enforceSandboxFlags(m_sandboxMask);
         if (m_enforceStrictMixedContentChecking)
             document->enforceStrictMixedContentChecking();
         if (didSetReferrerPolicy())
             document->setReferrerPolicy(m_referrerPolicy);
 
@@ skipping 718 matching lines @@
     // Collisions have no security impact, so we can save space by storing only the string's hash rather than the whole report.
     return !m_violationReportsSent.contains(report.impl()->hash());
 }
 
 void ContentSecurityPolicy::didSendViolationReport(const String& report)
 {
     m_violationReportsSent.add(report.impl()->hash());
 }
 
 } // namespace blink