CSP, PlzNavigate: make clear what happens with unique origins.

content/common/content_security_policy/csp_source_list_unittest.cc

 // Copyright 2017 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/content_security_policy/csp_source_list.h"
 #include "content/common/content_security_policy/csp_context.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace content {
 
@@ skipping 74 matching lines @@
 TEST(CSPSourceList, AllowNone) {
   CSPContext context;
   context.SetSelf(url::Origin(GURL("http://example.com")));
   CSPSourceList source_list(false,                      // allow_self
                             false,                      // allow_star:
                             std::vector<CSPSource>());  // source_list
   EXPECT_FALSE(Allow(source_list, GURL("http://example.com"), &context));
   EXPECT_FALSE(Allow(source_list, GURL("https://example.test/"), &context));
 }
 
+TEST(CSPSourceTest, SelfIsUnique) {
+  // Policy: 'self'
+  CSPSourceList source_list(true,                       // allow_self
+                            false,                      // allow_star:
+                            std::vector<CSPSource>());  // source_list
+  CSPContext context;
+
+  context.SetSelf(url::Origin(GURL("http://a.com")));
+  EXPECT_TRUE(Allow(source_list, GURL("http://a.com"), &context));
+  EXPECT_FALSE(Allow(source_list, GURL("data:text/html,hello"), &context));
+
+  context.SetSelf(url::Origin(GURL("data:text/html,<iframe src=[...]>")));
+  EXPECT_FALSE(Allow(source_list, GURL("http://a.com"), &context));
+  EXPECT_FALSE(Allow(source_list, GURL("data:text/html,hello"), &context));
+}
+
 }  // namespace content