Convert RSS extension to use manifest version 2 (with CSP protection).

Convert RSS extension to use manifest version 2 (with CSP protection).

Also filter out unwanted protocols from the feed list.

This CL is a continuation of Mike West's changelist to convert the RSS extension to version 2 (with some additional code).

BUG=128256, 91986
TEST=RSS Extension (and automated tests) should work as before.
Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=137873

[abarth-chromium, 2012-05-17 17:02:32]

LGTM

http://codereview.chromium.org/10407017/diff/1/chrome/test/data/extensions/su...
File chrome/test/data/extensions/subscribe_page_action/subscribe.js (right):

http://codereview.chromium.org/10407017/diff/1/chrome/test/data/extensions/su...
chrome/test/data/extensions/subscribe_page_action/subscribe.js:148:
'value="script-src \'self\';">';
Can you add an object-src directive here?  Assuming you're not using any
plugins, you can probably use object-src 'none'

[Finnur, 2012-05-17 19:20:37]

https://chromiumcodereview.appspot.com/10407017/diff/1/chrome/test/data/exten...
File chrome/test/data/extensions/subscribe_page_action/subscribe.js (right):

https://chromiumcodereview.appspot.com/10407017/diff/1/chrome/test/data/exten...
chrome/test/data/extensions/subscribe_page_action/subscribe.js:148:
'value="script-src \'self\';">';
Added. I'm not using any plugins (that I know of) but the question is really
"are the feeds we render using plugins to do so?"

... and if they are, should we even be allowing that? I'm leaning towards no on
that. We can try this out and see what happens.

I'll run this CL again through my manual tests (automated test running is in
progress) and if it looks good I'll check it in.

Thanks!


On 2012/05/17 17:02:34, abarth wrote:
> Can you add an object-src directive here?  Assuming you're not using any
> plugins, you can probably use object-src 'none'