Add sanbdoxed_pages to allow extension/app pages to be served in a sandboxed, unique origin

chrome/browser/extensions/extension_protocols.cc

Index: chrome/browser/extensions/extension_protocols.cc
diff --git a/chrome/browser/extensions/extension_protocols.cc b/chrome/browser/extensions/extension_protocols.cc
index e42c4c7cfe050019bb2304a3bb588f26df82b289..1195e6062f8b86f6070a375bfc56c7782654aa8e 100644
--- a/chrome/browser/extensions/extension_protocols.cc
+++ b/chrome/browser/extensions/extension_protocols.cc
@@ -278,10 +278,13 @@ ExtensionProtocolHandler::MaybeCreateJob(net::URLRequest* request) const {
   std::string content_security_policy;
   bool send_cors_header = false;
   if (extension) {
-    content_security_policy = extension->content_security_policy();
+    std::string resource_path = request->url().path();
+    content_security_policy = extension->IsResourceSandboxed(resource_path) ?

[Aaron Boodman, 2012/06/04 07:05:42]

It's kinda a shame that this doesn't pick up any of the other declarations from
content_security_policy().

Perhaps we are going about this wrong? What if we just allow developers to
specify the sandbox directive for some resources, and with that allow
allow-scripts, allow-forms, etc.

I'm not sure why Adam decided that the <meta> tag syntax was not appropriate for
policy delivery in the extension system, but if we can't use that, per-resource
policies could be defined in the manifest.

[Mihai Parparita -not on Chrome, 2012/06/04 18:27:02]

BTW, the content_security_policy manifest value isn't used for platform apps
(they can't override the default CSP, since they can't load remote scripts
regardless).

Generally, the <meta> tag approach isn't enough, since if there are multiple CSP
values for a page (the manifest one in the header, and the <meta> one) then they
all have to (i.e. additional CSP values can only make things stricter). <meta>
is also annoying because you have to repeat it for every page.

I can change this approach to something like:

sandboxed_resources: {
  // Additional CSP that would be combined with the the default sandboxed CSP
(as defined in this CL)
  "content_security_policy": "media-src: *"
  "resources" [
    "
  ]
}

However, that seems like additional complexity that no developers have asked
for. I can still turn sandboxed_resources into a dictionary so that we have the
option of extending this in the future.

+        extension_misc::kSandboxedContentSecurityPolicy :
+        extension->content_security_policy();
     if ((extension->manifest_version() >= 2 ||
              extension->HasWebAccessibleResources()) &&
-        extension->IsResourceWebAccessible(request->url().path()))
+        extension->IsResourceWebAccessible(resource_path))
       send_cors_header = true;
   }