See in particular https://w3c.github.io/webappsec-csp/#match-url-to-source-list > 2. If source list is an empty list, return "Does Not Match".
Bug 1570722 Comment 6 Edit History
Note: The actual edited comment in the bug view page will always show the original commenter’s name and original timestamp.
See in particular https://w3c.github.io/webappsec-csp/#match-url-to-source-list > 2. If source list is an empty list, return "Does Not Match". Clearly we need a CSP WPT test for this case.