Fix pyauto test: testSpecialURLTab

Add Content-Security-Policy to chrome://tcmalloc

Also, restart the browser so that each URL gets a fresh instance in the test.

BUG=88574
TEST=

Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=134601

[Nirnimesh, 2012-04-27 22:35:45]

I'm disabling CSP check for about:tcmalloc
Not sure if this is right, but this test is failing right now and I'm trying to
get it to pass again.

[Tom Sepez, 2012-04-28 01:19:05]

This appears to be crrev.com/133816 and possibly a real security regression. 
I've added jamesr to the cc list to ensure that the new data source is sending a
content-security-policy header.  Otherwise, it may just be that the URL
requested no longer exists.  Thanks.

[Tom Sepez, 2012-04-28 01:30:28]

Looking at your changes, I'd say this is a real security regression.  Please do
not commit this.  Instead a X-WebKit-CSP header needs to be supplied for the
tcmalloc page.

[jamesr, 2012-04-28 03:28:59]

I didn't intend to change any headers served by chrome://tcmalloc, but I can
completely believe that was an accidental side effect of my change.  Would a
<meta> suffice?  I could easily add that (it would just go in
TcmallocInternalsRequestJob::GetData()- adding a real HTTP header would take a
bit more researching.

[jamesr, 2012-04-28 03:35:18]

I think the issue is the new chrome://tcmalloc code bypasses
http://code.google.com/searchframe#OAMlx_jo-ck/src/chrome/browser/ui/webui/ch...

Tom - can you check if chrome://view-http-cache/ is OK?

It looks like everyone else is using a <meta> tag

[Tom Sepez, 2012-04-30 16:46:36]

> Tom - can you check if chrome://view-http-cache/ is OK?
That page has a suitable meta tag.  Did this also move off of
chrome_url_data_manager_backend.cc as its data source?


> It looks like everyone else is using a <meta> tag
Not sure what pages you mean by "everyone else" - out intent was that
chrome_url_data_manager_backend.cc would specify the header so that all of its
pages would get it automatically.   Having your new data source do the same
thing would be ideal.  The meta tag works, but it less desirable long-term.

[jamesr1, 2012-04-30 16:52:49]

There are (at least) 3 data sources in content/ now that can't use
chrome_url_data_manager_backen d.cc. I assume this number is more likely to
grow than not as stuff migrates between chrome and content. Seems to me a
meta is the only option for now short of duplicating the
chrome_url_data_manager_backend inside of comment.

Anyway, I'm out of town for most of this week so I likely won't get to
anything. I think adding the meta is pretty trivial, feel free to do that
or back the original patch out if you must have a fix this week.

- James
On Apr 30, 2012 9:46 AM, <tsepez@chromium.org> wrote:

>  > Tom - can you check if chrome://view-http-cache/ is OK?
> That page has a suitable meta tag.  Did this also move off of
> chrome_url_data_manager_**backend.cc as its data source?
>
>
>  It looks like everyone else is using a <meta> tag
>>
> Not sure what pages you mean by "everyone else" - out intent was that
> chrome_url_data_manager_**backend.cc would specify the header so that all
> of its
> pages would get it automatically.   Having your new data source do the same
> thing would be ideal.  The meta tag works, but it less desirable long-term.
>
>
>
>
http://codereview.chromium.**org/10178028/<http://codereview.chromium.org/101...
>

[Tom Sepez, 2012-04-30 17:02:23]

+estade.

Do we need a content_url_manager_backend?  Do we want to proliferate specific
data sources as these things migrate to content?

[Tom Sepez, 2012-04-30 17:09:09]

Nirnimesh, could you try adding a meta tag to tcmalloc_internals_request_job.cc
and retesting?  If so, then this is the right way to resolve this for now.

<meta http-equiv="X-WebKit-CSP" content="object-src 'none'; script-src 'none'
'unsafe-eval'">

[Nirnimesh, 2012-04-30 19:10:12]

On 2012/04/30 17:09:09, Tom Sepez wrote:
> Nirnimesh, could you try adding a meta tag to
tcmalloc_internals_request_job.cc
> and retesting?  If so, then this is the right way to resolve this for now.
> 
> <meta http-equiv="X-WebKit-CSP" content="object-src 'none'; script-src 'none'
> 'unsafe-eval'">

Done.

[Tom Sepez, 2012-04-30 19:23:34]

LGTM.

[Nirnimesh, 2012-04-30 19:27:26]

+sky for content/browser owners approval.

[sky, 2012-04-30 20:34:44]

I don't know anything about this code. Is there someone else that can review?

[Nirnimesh, 2012-04-30 20:41:44]

On 2012/04/30 20:34:44, sky wrote:
> I don't know anything about this code. Is there someone else that can review?

tsepez has already reviewed.
content/browser change is a one-liner. Mostly looking for rubberstamping here.

[sky, 2012-04-30 21:09:32]

Rubber stamp LGTM