bool CSPSource::schemeMatches(const KURL& url) const
 {
     if (m_scheme.isEmpty())
         return m_policy->protocolMatchesSelf(url);
     return equalIgnoringCase(url.protocol(), m_scheme);
 }

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.