db-d2/primevul-codebert-embeddings huggingface dataset:
Commit message: None
CVE: CVE-2015-1216
Vulnerability description: Use-after-free vulnerability in the V8Window::namedPropertyGetterCustom function in bindings/core/v8/custom/V8WindowCustom.cpp in the V8 bindings in Blink, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a frame detachment.

Project: Chrome

void V8Window::namedPropertyGetterCustom(v8::Local<v8::Name> name, const v8::PropertyCallbackInfo<v8::Value>& info)
{
    if (!name->IsString())
        return;

    auto nameString = name.As<v8::String>();
    LocalDOMWindow* window = toLocalDOMWindow(V8Window::toImpl(info.Holder()));
    if (!window)
        return;

    LocalFrame* frame = window->frame();
    if (!frame)
        return;

    AtomicString propName = toCoreAtomicString(nameString);
    Frame* child = frame->tree().scopedChild(propName);
    if (child) {
        v8SetReturnValueFast(info, child->domWindow(), window);
        return;
    }

     if (!info.Holder()->GetRealNamedProperty(nameString).IsEmpty())
         return;
 
    // Frame could have been detached in call to GetRealNamedProperty.
    frame = window->frame();
    // window is detached.
    if (!frame)
        return;

     Document* doc = frame->document();
 
    if (doc && doc->isHTMLDocument()) {
        if (toHTMLDocument(doc)->hasNamedItem(propName) || doc->hasElementWithId(propName)) {
            RefPtrWillBeRawPtr<HTMLCollection> items = doc->windowNamedItems(propName);
            if (!items->isEmpty()) {
                if (items->hasExactlyOneItem()) {
                    v8SetReturnValueFast(info, items->item(0), window);
                    return;
                }
                v8SetReturnValueFast(info, items.release(), window);
                return;
            }
        }
    }
}
Commit message: None
CVE: CVE-2015-1223
Vulnerability description: Multiple use-after-free vulnerabilities in core/html/HTMLInputElement.cpp in the DOM implementation in Blink, as used in Google Chrome before 41.0.2272.76, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger extraneous change events, as demonstrated by events for invalid input or input to read-only fields, related to the initializeTypeInParsing and updateType functions.

Project: Chrome

bool PermissionUtil::GetPermissionType(ContentSettingsType type,
                                       PermissionType* out) {
  if (type == CONTENT_SETTINGS_TYPE_GEOLOCATION) {
    *out = PermissionType::GEOLOCATION;
  } else if (type == CONTENT_SETTINGS_TYPE_NOTIFICATIONS) {
     *out = PermissionType::NOTIFICATIONS;
   } else if (type == CONTENT_SETTINGS_TYPE_PUSH_MESSAGING) {
     *out = PermissionType::PUSH_MESSAGING;
  } else if (type == CONTENT_SETTINGS_TYPE_MIDI) {
    *out = PermissionType::MIDI;
   } else if (type == CONTENT_SETTINGS_TYPE_MIDI_SYSEX) {
     *out = PermissionType::MIDI_SYSEX;
   } else if (type == CONTENT_SETTINGS_TYPE_DURABLE_STORAGE) {
    *out = PermissionType::DURABLE_STORAGE;
  } else if (type == CONTENT_SETTINGS_TYPE_MEDIASTREAM_CAMERA) {
    *out = PermissionType::VIDEO_CAPTURE;
  } else if (type == CONTENT_SETTINGS_TYPE_MEDIASTREAM_MIC) {
    *out = PermissionType::AUDIO_CAPTURE;
  } else if (type == CONTENT_SETTINGS_TYPE_BACKGROUND_SYNC) {
    *out = PermissionType::BACKGROUND_SYNC;
  } else if (type == CONTENT_SETTINGS_TYPE_PLUGINS) {
    *out = PermissionType::FLASH;
#if defined(OS_ANDROID) || defined(OS_CHROMEOS)
  } else if (type == CONTENT_SETTINGS_TYPE_PROTECTED_MEDIA_IDENTIFIER) {
    *out = PermissionType::PROTECTED_MEDIA_IDENTIFIER;
#endif
  } else {
    return false;
  }
  return true;
}
Commit message: None
CVE: CVE-2015-1302
CWE: CWE-20
Vulnerability description: The PDF viewer in Google Chrome before 46.0.2490.86 does not properly restrict scripting messages and API exposure, which allows remote attackers to bypass the Same Origin Policy via an unintended embedder or unintended plugin loading, related to pdf.js and out_of_process_instance.cc.

Project: Chrome

bool OutOfProcessInstance::Init(uint32_t argc,
                                 const char* argn[],
                                 const char* argv[]) {
  // the plugin to be loaded in the extension and print preview to avoid
  // exposing sensitive APIs directly to external websites.
   pp::Var document_url_var = pp::URLUtil_Dev::Get()->GetDocumentURL(this);
  if (!document_url_var.is_string())
    return false;
  std::string document_url = document_url_var.AsString();
   std::string extension_url = std::string(kChromeExtension);
  std::string print_preview_url = std::string(kChromePrint);
  if (!base::StringPiece(document_url).starts_with(kChromeExtension) &&
      !base::StringPiece(document_url).starts_with(kChromePrint)) {
    return false;
  }

  // Check if the plugin is full frame. This is passed in from JS.
  for (uint32_t i = 0; i < argc; ++i) {
    if (strcmp(argn[i], "full-frame") == 0) {
      full_ = true;
      break;
     }
   }
 
  if (full_)
    SetPluginToHandleFindRequests();

  pp::VarDictionary translated_strings;
  translated_strings.Set(kType, kJSSetTranslatedStringsType);
  translated_strings.Set(kJSGetPasswordString,
      GetLocalizedString(PP_RESOURCESTRING_PDFGETPASSWORD));
  translated_strings.Set(kJSLoadingString,
      GetLocalizedString(PP_RESOURCESTRING_PDFLOADING));
  translated_strings.Set(kJSLoadFailedString,
      GetLocalizedString(PP_RESOURCESTRING_PDFLOAD_FAILED));
  PostMessage(translated_strings);

  text_input_.reset(new pp::TextInput_Dev(this));

  const char* stream_url = nullptr;
  const char* original_url = nullptr;
  const char* headers = nullptr;
  bool is_material = false;
  for (uint32_t i = 0; i < argc; ++i) {
    if (strcmp(argn[i], "src") == 0)
      original_url = argv[i];
    else if (strcmp(argn[i], "stream-url") == 0)
      stream_url = argv[i];
    else if (strcmp(argn[i], "headers") == 0)
      headers = argv[i];
    else if (strcmp(argn[i], "is-material") == 0)
      is_material = true;
    else if (strcmp(argn[i], "top-toolbar-height") == 0)
      base::StringToInt(argv[i], &top_toolbar_height_);
  }

  if (is_material)
    background_color_ = kBackgroundColorMaterial;
  else
    background_color_ = kBackgroundColor;

  if (!original_url)
    return false;

  if (!stream_url)
    stream_url = original_url;

  if (IsPrintPreviewUrl(original_url))
    return true;

  LoadUrl(stream_url);
  url_ = original_url;
  return engine_->New(original_url, headers);
}
Commit message: None
CVE: CVE-2016-5152
CWE: CWE-190
Vulnerability description: Integer overflow in the opj_tcd_get_decoded_tile_size function in tcd.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data.

Project: Chrome

ChooserContextBase::GetGrantedObjects(const GURL& requesting_origin,
                                      const GURL& embedding_origin) {
  DCHECK_EQ(requesting_origin, requesting_origin.GetOrigin());
  DCHECK_EQ(embedding_origin, embedding_origin.GetOrigin());

  if (!CanRequestObjectPermission(requesting_origin, embedding_origin))
     return {};
 
   std::vector<std::unique_ptr<Object>> results;
  content_settings::SettingInfo info;
   std::unique_ptr<base::DictionaryValue> setting =
      GetWebsiteSetting(requesting_origin, embedding_origin, &info);
   std::unique_ptr<base::Value> objects;
   if (!setting->Remove(kObjectListKey, &objects))
     return results;

  std::unique_ptr<base::ListValue> object_list =
      base::ListValue::From(std::move(objects));
  if (!object_list)
    return results;

  for (auto& object : *object_list) {
     base::DictionaryValue* object_dict;
     if (object.GetAsDictionary(&object_dict) && IsValidObject(*object_dict)) {
       results.push_back(std::make_unique<Object>(
          requesting_origin, embedding_origin, object_dict, info.source,
           host_content_settings_map_->is_incognito()));
     }
   }
  return results;
}
Commit message: None
CVE: CVE-2016-5156
CWE: CWE-416
Vulnerability description: extensions/renderer/event_bindings.cc in the event bindings in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux attempts to process filtered events after failure to add an event matcher, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via unknown vectors.

Project: Chrome

void EventBindings::AttachFilteredEvent(
    const v8::FunctionCallbackInfo<v8::Value>& args) {
  CHECK_EQ(2, args.Length());
  CHECK(args[0]->IsString());
  CHECK(args[1]->IsObject());

  std::string event_name = *v8::String::Utf8Value(args[0]);
  if (!context()->HasAccessOrThrowError(event_name))
    return;

  std::unique_ptr<base::DictionaryValue> filter;
  {
    std::unique_ptr<content::V8ValueConverter> converter(
        content::V8ValueConverter::create());
    std::unique_ptr<base::Value> filter_value(converter->FromV8Value(
        v8::Local<v8::Object>::Cast(args[1]), context()->v8_context()));
    if (!filter_value || !filter_value->IsType(base::Value::TYPE_DICTIONARY)) {
      args.GetReturnValue().Set(static_cast<int32_t>(-1));
      return;
    }
     filter = base::DictionaryValue::From(std::move(filter_value));
   }
 
   int id = g_event_filter.Get().AddEventMatcher(
       event_name, ParseEventMatcher(std::move(filter)));
  if (id == -1) {
    args.GetReturnValue().Set(static_cast<int32_t>(-1));
    return;
  }
   attached_matcher_ids_.insert(id);
 
  const EventMatcher* matcher = g_event_filter.Get().GetEventMatcher(id);
  DCHECK(matcher);
  base::DictionaryValue* filter_weak = matcher->value();
   std::string extension_id = context()->GetExtensionID();
   if (AddFilter(event_name, extension_id, *filter_weak)) {
     bool lazy = ExtensionFrameHelper::IsContextForEventPage(context());
    content::RenderThread::Get()->Send(new ExtensionHostMsg_AddFilteredListener(
        extension_id, event_name, *filter_weak, lazy));
  }

  args.GetReturnValue().Set(static_cast<int32_t>(id));
}
Commit message: None
CVE: CVE-2016-5158
CWE: CWE-190
Vulnerability description: Multiple integer overflows in the opj_tcd_init_tile function in tcd.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted JPEG 2000 data.

Project: Chrome

void AXTree::PopulateOrderedSetItems(const AXNode* ordered_set,
                                     const AXNode* local_parent,
                                     std::vector<const AXNode*>& items,
                                     bool node_is_radio_button) const {
  if (!(ordered_set == local_parent)) {
    if (local_parent->data().role == ordered_set->data().role)
      return;
  }

   for (int i = 0; i < local_parent->child_count(); ++i) {
     const AXNode* child = local_parent->GetUnignoredChildAtIndex(i);
 
    // Invisible children should not be counted.
    // However, in the collapsed container case (e.g. a combobox), items can
    // still be chosen/navigated. However, the options in these collapsed
    // containers are historically marked invisible. Therefore, in that case,
    // count the invisible items. Only check 2 levels up, as combobox containers
    // are never higher.
    if (child->data().HasState(ax::mojom::State::kInvisible) &&
        !IsCollapsed(local_parent) && !IsCollapsed(local_parent->parent())) {
      continue;
    }

     if (node_is_radio_button &&
         child->data().role == ax::mojom::Role::kRadioButton)
      items.push_back(child);

    if (!node_is_radio_button && child->SetRoleMatchesItemRole(ordered_set))
      items.push_back(child);

    if (child->data().role == ax::mojom::Role::kGenericContainer ||
        child->data().role == ax::mojom::Role::kIgnored) {
      PopulateOrderedSetItems(ordered_set, child, items, node_is_radio_button);
    }
  }
}
Commit message: None
CVE: CVE-2016-5182
CWE: CWE-119
Vulnerability description: Blink in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation in bitmap handling, which allowed a remote attacker to potentially exploit heap corruption via crafted HTML pages.

Project: Chrome

void PageFormAnalyserLogger::Flush() {
  std::string text;
  for (ConsoleLevel level : {kError, kWarning, kVerbose}) {
    for (LogEntry& entry : node_buffer_[level]) {
       text.clear();
       text += "[DOM] ";
       text += entry.message;

      std::vector<blink::WebNode> nodesToLog;
      for (unsigned i = 0; i < entry.nodes.size(); ++i) {
        if (entry.nodes[i].IsElementNode()) {
          const blink::WebElement element =
              entry.nodes[i].ToConst<blink::WebElement>();
          const blink::WebInputElement* webInputElement =
              blink::ToWebInputElement(&element);

          // Filter out password inputs with values from being logged, as their
          // values are also logged.
          const bool shouldObfuscate =
              webInputElement &&
              webInputElement->IsPasswordFieldForAutofill() &&
              !webInputElement->Value().IsEmpty();

          if (!shouldObfuscate) {
            text += " %o";
            nodesToLog.push_back(element);
          }
        }
      }
 
       blink::WebConsoleMessage message(level, blink::WebString::FromUTF8(text));
      message.nodes = std::move(nodesToLog);  // avoids copying node vectors.
       frame_->AddMessageToConsole(message);
     }
   }
  node_buffer_.clear();
}
Commit message: None
CVE: CVE-2016-5187
CWE: CWE-20
Vulnerability description: Google Chrome prior to 54.0.2840.85 for Android incorrectly handled rapid transition into and out of full screen mode, which allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via crafted HTML pages.

Project: Chrome

void RemoveActionCallback(const ActionCallback& callback) {
  DCHECK(g_task_runner.Get());
   DCHECK(g_task_runner.Get()->BelongsToCurrentThread());
   std::vector<ActionCallback>* callbacks = g_callbacks.Pointer();
   for (size_t i = 0; i < callbacks->size(); ++i) {
    if ((*callbacks)[i] == callback) {
       callbacks->erase(callbacks->begin() + i);
       return;
     }
  }
}
Commit message: None
CVE: CVE-2016-5191
CWE: CWE-79
Vulnerability description: Bookmark handling in Google Chrome prior to 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation of supplied data, which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via crafted HTML pages, as demonstrated by an interpretation conflict between userinfo and scheme in an http://javascript:payload@example.com URL.

Project: Chrome

 base::string16 FormatBookmarkURLForDisplay(const GURL& url) {
  // and trailing slash, and unescape most characters. However, it's
  url_formatter::FormatUrlTypes format_types =
      url_formatter::kFormatUrlOmitAll &
      ~url_formatter::kFormatUrlOmitUsernamePassword;

  // If username is present, we must not omit the scheme because FixupURL() will
  // subsequently interpret the username as a scheme. crbug.com/639126
  if (url.has_username())
    format_types &= ~url_formatter::kFormatUrlOmitHTTP;

  return url_formatter::FormatUrl(url, format_types, net::UnescapeRule::SPACES,
                                  nullptr, nullptr, nullptr);
 }
Commit message: None
CVE: CVE-2016-1647
Vulnerability description: Use-after-free vulnerability in the RenderWidgetHostImpl::Destroy function in content/browser/renderer_host/render_widget_host_impl.cc in the Navigation implementation in Google Chrome before 49.0.2623.108 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

Project: Chrome

void RenderWidgetHostImpl::Destroy(bool also_delete) {
  DCHECK(!destroyed_);
  destroyed_ = true;

  NotificationService::current()->Notify(
      NOTIFICATION_RENDER_WIDGET_HOST_DESTROYED, Source<RenderWidgetHost>(this),
      NotificationService::NoDetails());

  if (view_) {
    view_->Destroy();
    view_.reset();
  }

  process_->RemoveRoute(routing_id_);
  g_routing_id_widget_map.Get().erase(
      RenderWidgetHostID(process_->GetID(), routing_id_));

   if (delegate_)
     delegate_->RenderWidgetDeleted(this);
 
  if (also_delete) {
    CHECK(!owner_delegate_);
     delete this;
  }
 }
Commit message: None
CVE: CVE-2016-1631
CWE: CWE-264
Vulnerability description: The PPB_Flash_MessageLoop_Impl::InternalRun function in content/renderer/pepper/ppb_flash_message_loop_impl.cc in the Pepper plugin in Google Chrome before 49.0.2623.75 mishandles nested message loops, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.

Project: Chrome

int32_t PPB_Flash_MessageLoop_Impl::InternalRun(
    const RunFromHostProxyCallback& callback) {
  if (state_->run_called()) {
    if (!callback.is_null())
      callback.Run(PP_ERROR_FAILED);
    return PP_ERROR_FAILED;
  }
  state_->set_run_called();
  state_->set_run_callback(callback);

  scoped_refptr<State> state_protector(state_);
   {
     base::MessageLoop::ScopedNestableTaskAllower allow(
         base::MessageLoop::current());
    blink::WebView::willEnterModalLoop();

     base::MessageLoop::current()->Run();

    blink::WebView::didExitModalLoop();
   }
 
  return state_protector->result();
}

Project: Chrome

 void TestFlashMessageLoop::DestroyMessageLoopResourceTask(int32_t unused) {
   if (message_loop_) {
     delete message_loop_;
    message_loop_ = nullptr;
   } else {
     PP_NOTREACHED();
   }
}

Project: Chrome

 void TestFlashMessageLoop::RunTests(const std::string& filter) {
   RUN_TEST(Basics, filter);
   RUN_TEST(RunWithoutQuit, filter);
  RUN_TEST(SuspendScriptCallbackWhileRunning, filter);
}

void TestFlashMessageLoop::DidRunScriptCallback() {
  // Script callbacks are not supposed to run while the Flash message loop is
  // running.
  if (message_loop_)
    suspend_script_callback_result_ = false;
}

pp::deprecated::ScriptableObject* TestFlashMessageLoop::CreateTestObject() {
  if (!instance_so_)
    instance_so_ = new InstanceSO(this);
  return instance_so_;
 }

Project: Chrome

 std::string TestFlashMessageLoop::TestBasics() {
  message_loop_ = new pp::flash::MessageLoop(instance_);

  pp::CompletionCallback callback = callback_factory_.NewCallback(
      &TestFlashMessageLoop::QuitMessageLoopTask);
  pp::Module::Get()->core()->CallOnMainThread(0, callback);
  int32_t result = message_loop_->Run();
 
   ASSERT_TRUE(message_loop_);
   delete message_loop_;
  message_loop_ = nullptr;
 
   ASSERT_EQ(PP_OK, result);
   PASS();
}

Project: Chrome

 TestFlashMessageLoop::TestFlashMessageLoop(TestingInstance* instance)
     : TestCase(instance),

Project: Chrome

std::string TestFlashMessageLoop::TestRunWithoutQuit() {
  message_loop_ = new pp::flash::MessageLoop(instance_);

  pp::CompletionCallback callback = callback_factory_.NewCallback(
      &TestFlashMessageLoop::DestroyMessageLoopResourceTask);
  pp::Module::Get()->core()->CallOnMainThread(0, callback);
  int32_t result = message_loop_->Run();
 
   if (message_loop_) {
     delete message_loop_;
    message_loop_ = nullptr;
     ASSERT_TRUE(false);
   }
 
   ASSERT_EQ(PP_ERROR_ABORTED, result);
   PASS();
 }

Project: Chrome

 TestFlashMessageLoop::~TestFlashMessageLoop() {
   PP_DCHECK(!message_loop_);

  ResetTestObject();
  if (instance_so_)
    instance_so_->clear_owner();
 }
Commit message: None
CVE: CVE-2016-1635
Vulnerability description: extensions/renderer/render_frame_observer_natives.cc in Google Chrome before 49.0.2623.75 does not properly consider object lifetimes and re-entrancy issues during OnDocumentElementCreated handling, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via unknown vectors.

Project: Chrome

  void CallbackAndDie(bool succeeded) {
    // Use PostTask to avoid running user scripts while handling this
    // DidFailProvisionalLoad notification.
    base::MessageLoop::current()->PostTask(FROM_HERE,
                                           base::Bind(callback_, false));
     delete this;
   }

Project: Chrome

  LoadWatcher(ScriptContext* context,
  LoadWatcher(content::RenderFrame* frame,
              const base::Callback<void(bool)>& callback)
      : content::RenderFrameObserver(frame), callback_(callback) {}

  void DidCreateDocumentElement() override {
    // The callback must be run as soon as the root element is available.
    // Running the callback may trigger DidCreateDocumentElement or
    // DidFailProvisionalLoad, so delete this before running the callback.
    base::Callback<void(bool)> callback = callback_;
    delete this;
    callback.Run(true);
   }

Project: Chrome

 void RenderFrameObserverNatives::OnDocumentElementCreated(
     const v8::FunctionCallbackInfo<v8::Value>& args) {
   CHECK(args.Length() == 2);
  CHECK(args[0]->IsInt32());
  CHECK(args[1]->IsFunction());

  int frame_id = args[0]->Int32Value();

  content::RenderFrame* frame = content::RenderFrame::FromRoutingID(frame_id);
  if (!frame) {
    LOG(WARNING) << "No render frame found to register LoadWatcher.";
     return;
   }
 
  v8::Global<v8::Function> v8_callback(context()->isolate(),
                                       args[1].As<v8::Function>());
  base::Callback<void(bool)> callback(
      base::Bind(&RenderFrameObserverNatives::InvokeCallback,
                 weak_ptr_factory_.GetWeakPtr(), base::Passed(&v8_callback)));
  if (ExtensionFrameHelper::Get(frame)->did_create_current_document_element()) {
    // If the document element is already created, then we can call the callback
    // immediately (though use PostTask to ensure that the callback is called
    // asynchronously).
    base::MessageLoop::current()->PostTask(FROM_HERE,
                                           base::Bind(callback, true));
  } else {
    new LoadWatcher(frame, callback);
  }
 
   args.GetReturnValue().Set(true);
 }
Commit message: None
CVE: CVE-2016-1616
CWE: CWE-254
Vulnerability description: The CustomButton::AcceleratorPressed function in ui/views/controls/button/custom_button.cc in Google Chrome before 48.0.2564.82 allows remote attackers to spoof URLs via vectors involving an unfocused custom button.

Project: Chrome

 bool CustomButton::AcceleratorPressed(const ui::Accelerator& accelerator) {
  // Should only handle accelerators when active. However, only top level
  // widgets can be active, so for child widgets check if they are focused
  // instead.
  if ((IsChildWidget() && !FocusInChildWidget()) ||
      (!IsChildWidget() && !GetWidget()->IsActive())) {
    return false;
  }
   SetState(STATE_NORMAL);
   ui::MouseEvent synthetic_event(
      ui::ET_MOUSE_RELEASED, gfx::Point(), gfx::Point(), ui::EventTimeForNow(),
      ui::EF_LEFT_MOUSE_BUTTON, ui::EF_LEFT_MOUSE_BUTTON);
  NotifyClick(synthetic_event);
  return true;
}
Commit message: None
CVE: CVE-2016-1617
CWE: CWE-200
Vulnerability description: The CSPSource::schemeMatches function in WebKit/Source/core/frame/csp/CSPSource.cpp in the Content Security Policy (CSP) implementation in Blink, as used in Google Chrome before 48.0.2564.82, does not apply http policies to https URLs and does not apply ws policies to wss URLs, which makes it easier for remote attackers to determine whether a specific HSTS web site has been visited by reading a CSP report.

Project: Chrome

bool CSPSource::schemeMatches(const KURL& url) const
 {
     if (m_scheme.isEmpty())
         return m_policy->protocolMatchesSelf(url);
    if (equalIgnoringCase(m_scheme, "http"))
        return equalIgnoringCase(url.protocol(), "http") || equalIgnoringCase(url.protocol(), "https");
    if (equalIgnoringCase(m_scheme, "ws"))
        return equalIgnoringCase(url.protocol(), "ws") || equalIgnoringCase(url.protocol(), "wss");
     return equalIgnoringCase(url.protocol(), m_scheme);
 }