Add Content-Security-Policy support to extensions

This change adds an experimental extension manifest attribute that lets
extension developers supply a Content-Security-Policy for their extension.
Review URL: http://codereview.chromium.org/6873059

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@82303 0039d316-1c4b-4281-b951-d872f2087c98

4 files changed, 35 insertions, 0 deletions

diff --git a/chrome/common/extensions/extension.cc b/chrome/common/extensions/extension.cc
index f978ee0..10c8d52 100644
--- a/chrome/common/extensions/extension.cc
+++ b/chrome/common/extensions/extension.cc
@@ -2376,6 +2376,27 @@ bool Extension::InitFromValue(const DictionaryValue& source, int flags,
     }
   }
 
+  if (CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kEnableExperimentalExtensionApis) &&
+      source.HasKey(keys::kContentSecurityPolicy)) {
+    std::string content_security_policy;
+    if (!source.GetString(keys::kContentSecurityPolicy,
+                          &content_security_policy)) {
+      *error = errors::kInvalidContentSecurityPolicy;
+      return false;
+    }
+    // We block these characters to prevent HTTP header injection when
+    // representing the content security policy as an HTTP header.
+    const char kBadCSPCharacters[] = {'\r', '\n', '\0'};
+    if (content_security_policy.find_first_of(kBadCSPCharacters, 0,
+                                              arraysize(kBadCSPCharacters)) !=
+        std::string::npos) {
+      *error = errors::kInvalidContentSecurityPolicy;
+      return false;
+    }
+    content_security_policy_ = content_security_policy;
+  }
+
   // Initialize devtools page url (optional).
   if (source.HasKey(keys::kDevToolsPage)) {
     std::string devtools_str;
diff --git a/chrome/common/extensions/extension.h b/chrome/common/extensions/extension.h
index d08f17e..e2309c3 100644
--- a/chrome/common/extensions/extension.h
+++ b/chrome/common/extensions/extension.h
@@ -616,6 +616,10 @@ class Extension : public base::RefCountedThreadSafe<Extension> {
 
   bool wants_file_access() const { return wants_file_access_; }
 
+  const std::string& content_security_policy() const {
+    return content_security_policy_;
+  }
+
   // App-related.
   bool is_app() const { return is_app_; }
   bool is_hosted_app() const { return is_app() && !web_extent().is_empty(); }
@@ -918,6 +922,11 @@ class Extension : public base::RefCountedThreadSafe<Extension> {
   // granted it that access).
   bool wants_file_access_;
 
+  // The Content-Security-Policy for this extension.  Extensions can use
+  // Content-Security-Policies to mitigate cross-site scripting and other
+  // vulnerabilities.
+  std::string content_security_policy_;
+
   FRIEND_TEST_ALL_PREFIXES(ExtensionServiceTest,
                            UpdateExtensionPreservesLocation);
   FRIEND_TEST_ALL_PREFIXES(ExtensionTest, LoadPageActionHelper);
diff --git a/chrome/common/extensions/extension_constants.cc b/chrome/common/extensions/extension_constants.cc
index fc5f4ef..5012f14 100644
--- a/chrome/common/extensions/extension_constants.cc
+++ b/chrome/common/extensions/extension_constants.cc
@@ -12,6 +12,7 @@ const char* kBackground = "background_page";
 const char* kBrowserAction = "browser_action";
 const char* kChromeURLOverrides = "chrome_url_overrides";
 const char* kContentScripts = "content_scripts";
+const char* kContentSecurityPolicy = "content_security_policy";
 const char* kConvertedFromUserScript = "converted_from_user_script";
 const char* kCss = "css";
 const char* kCurrentLocale = "current_locale";
@@ -147,6 +148,8 @@ const char* kInvalidChromeURLOverrides =
     "Invalid value for 'chrome_url_overrides'.";
 const char* kInvalidContentScript =
     "Invalid value for 'content_scripts[*]'.";
+const char* kInvalidContentSecurityPolicy =
+    "Invalid value for 'content_security_policy'.";
 const char* kInvalidContentScriptsList =
     "Invalid value for 'content_scripts'.";
 const char* kInvalidCss =
diff --git a/chrome/common/extensions/extension_constants.h b/chrome/common/extensions/extension_constants.h
index 6b703f3..97b698c 100644
--- a/chrome/common/extensions/extension_constants.h
+++ b/chrome/common/extensions/extension_constants.h
@@ -17,6 +17,7 @@ namespace extension_manifest_keys {
   extern const char* kBrowseURLs;
   extern const char* kChromeURLOverrides;
   extern const char* kContentScripts;
+  extern const char* kContentSecurityPolicy;
   extern const char* kConvertedFromUserScript;
   extern const char* kCss;
   extern const char* kCurrentLocale;
@@ -128,6 +129,7 @@ namespace extension_manifest_errors {
   extern const char* kInvalidChromeURLOverrides;
   extern const char* kInvalidContentScript;
   extern const char* kInvalidContentScriptsList;
+  extern const char* kInvalidContentSecurityPolicy;
   extern const char* kInvalidCss;
   extern const char* kInvalidCssList;
   extern const char* kInvalidDefaultLocale;