diff options
| author | mkwst <mkwst@chromium.org> | 2015-06-16 07:26:30 -0700 |
|---|---|---|
| committer | Commit bot <commit-bot@chromium.org> | 2015-06-16 14:26:55 +0000 |
| commit | 04a6c801d52357e7ad14ecaf8c528a97a3451fd5 (patch) | |
| tree | 9146c5fde1d40c5517b6d177cb4eb3b107109e8d /extensions/common/manifest_handlers | |
| parent | 0c5bb253c94ffb78ec155ec1cf83172975997879 (diff) | |
| download | chromium_src-04a6c801d52357e7ad14ecaf8c528a97a3451fd5.zip chromium_src-04a6c801d52357e7ad14ecaf8c528a97a3451fd5.tar.gz chromium_src-04a6c801d52357e7ad14ecaf8c528a97a3451fd5.tar.bz2 | |
Explicitly whitelist 'blob:' and 'filesystem:' in extensions' default CSP.
'blob:' and 'filesystem:' should not match 'self' in CSP source
expressions, but they currently do. In order to avoid breakage, this
patch whitelists them explicitly (which is a no-op at the moment) so that
we can change Blink's behavior without breaking extensions.
Perhaps we can re-evaluate this in v3. :)
BUG=473904
Review URL: https://codereview.chromium.org/1184353002
Cr-Commit-Position: refs/heads/master@{#334599}
Diffstat (limited to 'extensions/common/manifest_handlers')
| -rw-r--r-- | extensions/common/manifest_handlers/csp_info.cc | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/extensions/common/manifest_handlers/csp_info.cc b/extensions/common/manifest_handlers/csp_info.cc index e756995..5581d51 100644 --- a/extensions/common/manifest_handlers/csp_info.cc +++ b/extensions/common/manifest_handlers/csp_info.cc @@ -24,13 +24,15 @@ using csp_validator::SanitizeContentSecurityPolicy; namespace { const char kDefaultContentSecurityPolicy[] = - "script-src 'self' chrome-extension-resource:; object-src 'self';"; + "script-src 'self' blob: filesystem: chrome-extension-resource:; " + "object-src 'self' blob: filesystem:;"; #define PLATFORM_APP_LOCAL_CSP_SOURCES \ - "'self' data: chrome-extension-resource:" + "'self' blob: filesystem: data: chrome-extension-resource:" + const char kDefaultPlatformAppContentSecurityPolicy[] = // Platform apps can only use local resources by default. - "default-src 'self' chrome-extension-resource:;" + "default-src 'self' blob: filesystem: chrome-extension-resource:;" // For remote resources, they can fetch them via XMLHttpRequest. " connect-src *;" // And serve them via data: or same-origin (blob:, filesystem:) URLs |