Adding 'blob:' and 'filesystem:' URLs as secure sources for extensions.

Adding 'blob:' and 'filesystem:' URLs as secure sources for extensions.

Extensions currently enforce the requirement that Content Security Policy
directives contain only secure sources. As 'blob:' and 'filesystem:' URLs
are same-origin with the resource that created them, and never touch the
network, we should allow them in extensions' 'content_security_policy'
declarations.

BUG=144610
Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=153624

[Mike West, 2012-08-24 11:52:36]

Hello, Adam, Aaron, and Mihai!

Would you mind taking a look at this CL? Maps ran into this issue while working
on massaging their API into CSP compliance.

Thanks!

-mike

[abarth-chromium, 2012-08-24 14:55:00]

LGTM (but I am not an owner)

http://codereview.chromium.org/10873060/diff/1/chrome/common/extensions/csp_v...
File chrome/common/extensions/csp_validator.cc (right):

http://codereview.chromium.org/10873060/diff/1/chrome/common/extensions/csp_v...
chrome/common/extensions/csp_validator.cc:58: StartsWithASCII(source,
"filesystem:", true)) {
I suspect this should be LowerCaseEqualsASCII.  "blob://example.com" doesn't
make much sense.

http://codereview.chromium.org/10873060/diff/1/chrome/common/extensions/csp_v...
File chrome/common/extensions/csp_validator_unittest.cc (right):

http://codereview.chromium.org/10873060/diff/1/chrome/common/extensions/csp_v...
chrome/common/extensions/csp_validator_unittest.cc:98: "default-src 'self'
blob:http://example.com/XXX"));
I would EXPECT_FALSE here.  You can't load cross-origin blob URLs anyway.

http://codereview.chromium.org/10873060/diff/1/chrome/common/extensions/csp_v...
chrome/common/extensions/csp_validator_unittest.cc:102: "default-src 'self'
filesystem:http://example.com/XXX"));
Same for filesystem.

[Mike West, 2012-08-24 15:13:36]

Thanks Adam. Once Mihai or Aaron weighs in, I'll spin a new patch with the
stricter rules.

http://codereview.chromium.org/10873060/diff/1/chrome/common/extensions/csp_v...
File chrome/common/extensions/csp_validator_unittest.cc (right):

http://codereview.chromium.org/10873060/diff/1/chrome/common/extensions/csp_v...
chrome/common/extensions/csp_validator_unittest.cc:98: "default-src 'self'
blob:http://example.com/XXX"));
On 2012/08/24 14:55:00, abarth wrote:
> I would EXPECT_FALSE here.  You can't load cross-origin blob URLs anyway.

I can certainly change it to only accept the protocol-only source. I think
you're right; that's really all that makes sense.

[Mihai Parparita -not on Chrome, 2012-08-24 17:34:19]

Accepting only the scheme as a source makes sense to me.

Mihai

On Fri, Aug 24, 2012 at 8:13 AM, <mkwst@chromium.org> wrote:

> Thanks Adam. Once Mihai or Aaron weighs in, I'll spin a new patch with the
> stricter rules.
>
>
>
> http://codereview.chromium.**org/10873060/diff/1/chrome/**
>
common/extensions/csp_**validator_unittest.cc<http://codereview.chromium.org/10873060/diff/1/chrome/common/extensions/csp_validator_unittest.cc>
> File chrome/common/extensions/csp_**validator_unittest.cc (right):
>
> http://codereview.chromium.**org/10873060/diff/1/chrome/**
>
common/extensions/csp_**validator_unittest.cc#**newcode98<http://codereview.chromium.org/10873060/diff/1/chrome/common/extensions/csp_validator_unittest.cc#newcode98>
> chrome/common/extensions/csp_**validator_unittest.cc:98: "default-src
> 'self' blob:http://example.com/XXX"))**;
> On 2012/08/24 14:55:00, abarth wrote:
>
>> I would EXPECT_FALSE here.  You can't load cross-origin blob URLs
>>
> anyway.
>
> I can certainly change it to only accept the protocol-only source. I
> think you're right; that's really all that makes sense.
>
>
http://codereview.chromium.**org/10873060/<http://codereview.chromium.org/108...
>

[Mike West, 2012-08-27 08:46:12]

On 2012/08/24 17:34:19, Mihai Parparita wrote:
> Accepting only the scheme as a source makes sense to me.

The current patch does just that. Would you mind taking a look?

Thanks!

-mike

[Mihai Parparita -not on Chrome, 2012-08-27 23:40:14]

LGTM

[commit-bot: I haz the power, 2012-08-27 23:40:34]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/mkwst@chromium.org/10873060/9001

[commit-bot: I haz the power, 2012-08-28 04:06:49]

Change committed as 153624