Relax '*' in CSPSourceList to match the protected resource's protocol.

third_party/WebKit/Source/core/frame/csp/CSPSourceList.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/CSPSourceList.h"
 
 #include "core/frame/csp/CSPSource.h"
 #include "core/frame/csp/ContentSecurityPolicy.h"
 #include "platform/weborigin/KURL.h"
 #include "platform/weborigin/SecurityOrigin.h"
@@ skipping 29 matching lines @@
     , m_allowInline(false)
     , m_allowEval(false)
     , m_allowDynamic(false)
     , m_allowHashedAttributes(false)
     , m_hashAlgorithmsUsed(0)
 {
 }
 
 bool CSPSourceList::matches(const KURL& url, ResourceRequest::RedirectStatus redirectStatus) const
 {
-    // The CSP spec specifically states that only http:, https:, ws: and wss: should
-    // be captured by a '*" source.
-    // (https://w3c.github.io/webappsec-csp/#match-url-to-source-expression). Thus,
-    // in the case of a full wildcard, URLs with any other schemes are
-    // explicitly checked for in the source list before allowing them through.
+    // Wildcards match network schemes ('http', 'https', 'ws', 'wss'), and the scheme of the
+    // protected resource: https://w3c.github.io/webappsec-csp/#match-url-to-source-expression.
+    // Other schemes, including custom schemes, must be explicitly listed in a source list.
     if (m_allowStar) {
-        if (url.protocolIsInHTTPFamily() || url.protocolIs("ws") || url.protocolIs("wss"))
+        if (url.protocolIsInHTTPFamily() || url.protocolIs("ws") || url.protocolIs("wss") || m_policy->protocolMatchesSelf(url))
             return true;
 
         return hasSourceMatchInList(url, redirectStatus);
     }
 
     KURL effectiveURL = m_policy->selfMatchesInnerURL() && SecurityOrigin::shouldUseInnerURL(url) ? SecurityOrigin::extractInnerURL(url) : url;
 
     if (m_allowSelf && m_policy->urlMatchesSelf(effectiveURL))
         return true;
 
@@ skipping 473 matching lines @@
     return false;
 }
 
 DEFINE_TRACE(CSPSourceList)
 {
     visitor->trace(m_policy);
     visitor->trace(m_list);
 }
 
 } // namespace blink