only in patch2:
unchanged:
--- a/tests/src/Functional/SecKitTestCaseTest.php
+++ b/tests/src/Functional/SecKitTestCaseTest.php
@@ -97,11 +97,12 @@ class SecKitTestCaseTest extends BrowserTestBase {
       'seckit_xss[csp][child-src]' => '*',
       'seckit_xss[csp][font-src]' => '*',
       'seckit_xss[csp][connect-src]' => '*',
+      'seckit_xss[csp][base-uri]' => "*",
       'seckit_xss[csp][report-uri]' => $this->reportPath,
       'seckit_xss[csp][upgrade-req]' => TRUE,
     ];
     $this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
-    $expected = 'default-src *; script-src *; object-src *; style-src *; img-src *; media-src *; frame-src *; frame-ancestors *; child-src *; font-src *; connect-src *; report-uri ' . base_path() . $this->reportPath . '; upgrade-insecure-requests';
+    $expected = 'default-src *; script-src *; object-src *; style-src *; img-src *; media-src *; frame-src *; frame-ancestors *; child-src *; font-src *; connect-src *; base-uri *; report-uri ' . base_path() . $this->reportPath . '; upgrade-insecure-requests';
     $this->assertSession()->responseHeaderEquals('Content-Security-Policy', $expected);
     $this->assertSession()->responseHeaderEquals('X-Content-Security-Policy', $expected);
     $this->assertSession()->responseHeaderEquals('X-WebKit-CSP', $expected);
@@ -126,11 +127,12 @@ class SecKitTestCaseTest extends BrowserTestBase {
       'seckit_xss[csp][child-src]' => '*',
       'seckit_xss[csp][font-src]' => '*',
       'seckit_xss[csp][connect-src]' => '*',
+      'seckit_xss[csp][base-uri]' => '*',
       'seckit_xss[csp][report-uri]' => $this->reportPath,
       'seckit_xss[csp][upgrade-req]' => TRUE,
     ];
     $this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
-    $expected = 'default-src *; script-src *; object-src *; style-src *; img-src *; media-src *; frame-src *; frame-ancestors *; child-src *; font-src *; connect-src *; report-uri ' . base_path() . $this->reportPath . '; upgrade-insecure-requests';
+    $expected = 'default-src *; script-src *; object-src *; style-src *; img-src *; media-src *; frame-src *; frame-ancestors *; child-src *; font-src *; connect-src *; base-uri *; report-uri ' . base_path() . $this->reportPath . '; upgrade-insecure-requests';
     $this->assertSession()->responseHeaderEquals('Content-Security-Policy', $expected);
     $this->assertSession()->responseHeaderEquals('X-Content-Security-Policy', NULL);
     $this->assertSession()->responseHeaderEquals('X-WebKit-CSP', NULL);
@@ -155,11 +157,12 @@ class SecKitTestCaseTest extends BrowserTestBase {
       'seckit_xss[csp][child-src]' => '*',
       'seckit_xss[csp][font-src]' => '*',
       'seckit_xss[csp][connect-src]' => '*',
+      'seckit_xss[csp][base-uri]' => '*',
       'seckit_xss[csp][report-uri]' => $this->reportPath,
       'seckit_xss[csp][upgrade-req]' => TRUE,
     ];
     $this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
-    $expected = 'default-src *; script-src *; object-src *; style-src *; img-src *; media-src *; frame-src *; frame-ancestors *; child-src *; font-src *; connect-src *; report-uri ' . base_path() . $this->reportPath . '; upgrade-insecure-requests';
+    $expected = 'default-src *; script-src *; object-src *; style-src *; img-src *; media-src *; frame-src *; frame-ancestors *; child-src *; font-src *; connect-src *; base-uri *; report-uri ' . base_path() . $this->reportPath . '; upgrade-insecure-requests';
     $this->assertSession()->responseHeaderEquals('Content-Security-Policy', $expected);
     $this->assertSession()->responseHeaderEquals('X-Content-Security-Policy', $expected);
     $this->assertSession()->responseHeaderEquals('X-WebKit-CSP', NULL);
@@ -184,11 +187,12 @@ class SecKitTestCaseTest extends BrowserTestBase {
       'seckit_xss[csp][child-src]' => '*',
       'seckit_xss[csp][font-src]' => '*',
       'seckit_xss[csp][connect-src]' => '*',
+      'seckit_xss[csp][base-uri]' => '*',
       'seckit_xss[csp][report-uri]' => $this->reportPath,
       'seckit_xss[csp][upgrade-req]' => TRUE,
     ];
     $this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
-    $expected = 'default-src *; script-src *; object-src *; style-src *; img-src *; media-src *; frame-src *; frame-ancestors *; child-src *; font-src *; connect-src *; report-uri ' . base_path() . $this->reportPath . '; upgrade-insecure-requests';
+    $expected = 'default-src *; script-src *; object-src *; style-src *; img-src *; media-src *; frame-src *; frame-ancestors *; child-src *; font-src *; connect-src *; base-uri *; report-uri ' . base_path() . $this->reportPath . '; upgrade-insecure-requests';
     $this->assertSession()->responseHeaderEquals('Content-Security-Policy', $expected);
     $this->assertSession()->responseHeaderEquals('X-Content-Security-Policy', NULL);
     $this->assertSession()->responseHeaderEquals('X-WebKit-CSP', $expected);
@@ -215,6 +219,7 @@ class SecKitTestCaseTest extends BrowserTestBase {
       'seckit_xss[csp][child-src]'   => '*',
       'seckit_xss[csp][font-src]'    => '*',
       'seckit_xss[csp][connect-src]' => '*',
+      'seckit_xss[csp][base-uri]'    => '*',
       'seckit_xss[csp][report-uri]'  => $this->reportPath,
       'seckit_xss[csp][policy-uri]'  => 'http://mysite.com/csp.xml',
     ];
@@ -246,12 +251,13 @@ class SecKitTestCaseTest extends BrowserTestBase {
       'seckit_xss[csp][child-src]' => '',
       'seckit_xss[csp][font-src]' => '',
       'seckit_xss[csp][connect-src]' => '',
+      'seckit_xss[csp][base-uri]' => "'self'",
       'seckit_xss[csp][report-uri]' => $this->reportPath,
       'seckit_xss[csp][upgrade-req]' => FALSE,
       'seckit_xss[csp][policy-uri]' => '',
     ];
     $this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
-    $expected = "default-src self; report-uri " . base_path() . $this->reportPath;
+    $expected = "default-src self; base-uri 'self'; report-uri " . base_path() . $this->reportPath;
     $this->assertSession()->responseHeaderEquals('Content-Security-Policy', $expected);
     $this->assertSession()->responseHeaderEquals('X-Content-Security-Policy', $expected);
     $this->assertSession()->responseHeaderEquals('X-WebKit-CSP', $expected);
@@ -319,15 +325,16 @@ class SecKitTestCaseTest extends BrowserTestBase {
       $form['seckit_xss[csp][vendor-prefix][x]'] = TRUE;
       $form['seckit_xss[csp][vendor-prefix][webkit]'] = TRUE;
       $form['seckit_xss[csp][default-src]'] = 'self';
+      $form['seckit_xss[csp][base-uri]'] = "'self'";
       $form['seckit_xss[csp][report-uri]'] = $report_uri['uri'];
       $this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
       if ($report_uri['valid']) {
         $base_path = ($report_uri['absolute']) ? '' : base_path();
-        $expected = 'default-src self; report-uri ' . $base_path . $report_uri['uri'];
+        $expected = "default-src self; base-uri 'self'; report-uri " . $base_path . $report_uri['uri'];
         if (!$report_uri['absolute'] && strpos($report_uri['uri'], '/') === 0) {
           // In this case, check that the leading slash on the relative path
           // was not mistakenly turned into two leading slashes.
-          $expected = 'default-src self; report-uri ' . $base_path . ltrim($report_uri['uri'], '/');
+          $expected = "default-src self; base-uri 'self'; report-uri " . $base_path . ltrim($report_uri['uri'], '/');
         }
         $this->assertSession()->responseHeaderEquals('Content-Security-Policy', $expected);
         $this->assertSession()->responseHeaderEquals('X-Content-Security-Policy', $expected);