Add sanbdoxed_pages to allow extension/app pages to be served in a sandboxed, unique origin

chrome/browser/extensions/extension_protocols.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/extension_protocols.h"
 
 #include <algorithm>
 
 #include "base/compiler_specific.h"
 #include "base/file_path.h"
@@ skipping 260 matching lines @@
       directory_path = disabled_extension->path();
     if (directory_path.value().empty()) {
       LOG(WARNING) << "Failed to GetPathForExtension: " << extension_id;
       return NULL;
     }
   }
 
   std::string content_security_policy;
   bool send_cors_header = false;
   if (extension) {
-    content_security_policy = extension->content_security_policy();
+    std::string resource_path = request->url().path();
+    content_security_policy = extension->IsResourceSandboxed(resource_path) ?

[Aaron Boodman, 2012/06/04 07:05:42]

It's kinda a shame that this doesn't pick up any of the other declarations from
content_security_policy().

Perhaps we are going about this wrong? What if we just allow developers to
specify the sandbox directive for some resources, and with that allow
allow-scripts, allow-forms, etc.

I'm not sure why Adam decided that the <meta> tag syntax was not appropriate for
policy delivery in the extension system, but if we can't use that, per-resource
policies could be defined in the manifest.

[Mihai Parparita -not on Chrome, 2012/06/04 18:27:02]

BTW, the content_security_policy manifest value isn't used for platform apps
(they can't override the default CSP, since they can't load remote scripts
regardless).

Generally, the <meta> tag approach isn't enough, since if there are multiple CSP
values for a page (the manifest one in the header, and the <meta> one) then they
all have to (i.e. additional CSP values can only make things stricter). <meta>
is also annoying because you have to repeat it for every page.

I can change this approach to something like:

sandboxed_resources: {
  // Additional CSP that would be combined with the the default sandboxed CSP
(as defined in this CL)
  "content_security_policy": "media-src: *"
  "resources" [
    "
  ]
}

However, that seems like additional complexity that no developers have asked
for. I can still turn sandboxed_resources into a dictionary so that we have the
option of extending this in the future.

+        extension_misc::kSandboxedContentSecurityPolicy :
+        extension->content_security_policy();
     if ((extension->manifest_version() >= 2 ||
              extension->HasWebAccessibleResources()) &&
-        extension->IsResourceWebAccessible(request->url().path()))
+        extension->IsResourceWebAccessible(resource_path))
       send_cors_header = true;
   }
 
   std::string path = request->url().path();
   if (path.size() > 1 &&
       path.substr(1) == extension_filenames::kGeneratedBackgroundPageFilename) {
     return new GeneratedBackgroundPageJob(
         request, extension, content_security_policy);
   }
 
@@ skipping 42 matching lines @@
                                     content_security_policy, send_cors_header);
 }
 
 }  // namespace
 
 net::URLRequestJobFactory::ProtocolHandler* CreateExtensionProtocolHandler(
     bool is_incognito,
     ExtensionInfoMap* extension_info_map) {
   return new ExtensionProtocolHandler(is_incognito, extension_info_map);
 }