Disallow CSP source * matching of data:, blob:, and filesystem: URLs

The CSP spec specifically excludes matching of data:, blob:, and
filesystem: URLs with the source '*' wildcard. This adds checks to make
sure that doesn't happen, along with tests.

BUG=534570
R=mkwst@chromium.org

Review URL: https://codereview.chromium.org/1361763005

Cr-Commit-Position: refs/heads/master@{#350950}
bool CSPSourceList::parseNonce(const UChar* begin, const UChar* end, String& nonce)
{
    size_t nonceLength = end - begin;
    const char* prefix = "'nonce-";

    if (nonceLength <= strlen(prefix) || !equalIgnoringCase(prefix, begin, strlen(prefix)))
        return true;

    const UChar* position = begin + strlen(prefix);
    const UChar* nonceBegin = position;

    ASSERT(position < end);
    skipWhile<UChar, isNonceCharacter>(position, end);
    ASSERT(nonceBegin <= position);

    if (position + 1 != end || *position != '\'' || position == nonceBegin)
        return false;

    nonce = String(nonceBegin, position - nonceBegin);
    return true;
}

bool CSPSourceList::parseNonce(const UChar* begin, const UChar* end, String& nonce)
{
    size_t nonceLength = end - begin;
    const char* prefix = "'nonce-";

    if (nonceLength <= strlen(prefix) || !equalIgnoringCase(prefix, begin, strlen(prefix)))
        return true;

    const UChar* position = begin + strlen(prefix);
    const UChar* nonceBegin = position;

    ASSERT(position < end);
    skipWhile<UChar, isNonceCharacter>(position, end);
    ASSERT(nonceBegin <= position);

    if (position + 1 != end || *position != '\'' || position == nonceBegin)
        return false;

    nonce = String(nonceBegin, position - nonceBegin);
    return true;
}
