do not dedupe alternate schema source expresions

Author: keithamus

lib/secure_headers/headers/content_security_policy.rb

@@ -157,7 +157,7 @@ def dedup_source_list(sources)
       if wild_sources.any?
         sources.reject do |source|
           !wild_sources.include?(source) &&
-            wild_sources.any? { |pattern| File.fnmatch(pattern, source) }
+            wild_sources.any? { |pattern| URI(pattern).scheme == URI(source).scheme && File.fnmatch(pattern, source) }
         end
       else
         sources

spec/lib/secure_headers/headers/content_security_policy_spec.rb

@@ -106,6 +106,11 @@ module SecureHeaders
         expect(csp.value).to eq("default-src example.org")
       end
 
+      it "does not deduplicate non-matching schema source expressions" do
+        csp = ContentSecurityPolicy.new(default_src: %w(*.example.org wss://*.example.org))
+        expect(csp.value).to eq("default-src *.example.org wss://*.example.org")
+      end
+
       it "creates maximally strict sandbox policy when passed no sandbox token values" do
         csp = ContentSecurityPolicy.new(default_src: %w(example.org), sandbox: [])
         expect(csp.value).to eq("default-src example.org; sandbox")