Thanks @sideshowbarker !

I don't think this should be a warning note, it could just be a paragraph. And https://w3c.github.io/webappsec-csp/2/#match-source-expression is 404.

But also, I'm not sure I understand the content here. This is a version of the note at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors#sources, and it seems quite specific to iframes. But I don't understand what it means in the context of, say, the script-src directive.

It seems more like we want a general description of how URLs match against sources that omit the scheme, which presumably lives somewhere in https://w3c.github.io/webappsec-csp/#matching-urls.