`chrome-extension` resources should bypass Content Security Policy.

chrome/browser/extensions/extension_resource_request_policy_apitest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/logging.h"
 #include "chrome/browser/extensions/extension_apitest.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_tabstrip.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/test/base/ui_test_utils.h"
@@ skipping 199 matching lines @@
           "files/extensions/api_test/extension_resource_request_policy/"
           "web_accessible/nonaccessible_chrome_resource_scheme.html"));
   ui_test_utils::NavigateToURL(browser(), nonaccessible_cer_resource);
   ASSERT_TRUE(content::ExecuteJavaScriptAndExtractString(
     chrome::GetActiveWebContents(browser())->GetRenderViewHost(), L"",
       L"window.domAutomationController.send(document.title)",
     &result));
   EXPECT_EQ("Loading CER:// failed.", result);
 }
 
+IN_PROC_BROWSER_TEST_F(ExtensionResourceRequestPolicyTest,
+                       WebAccessibleResourcesWithCSP) {
+  std::string result;
+  ASSERT_TRUE(test_server()->Start());
+  ASSERT_TRUE(LoadExtension(test_data_dir_
+      .AppendASCII("extension_resource_request_policy")
+      .AppendASCII("web_accessible")));
+
+  GURL accessible_resource_with_csp(
+      test_server()->GetURL(
+          "files/extensions/api_test/extension_resource_request_policy/"
+          "web_accessible/accessible_resource_with_csp.html"));
+  ui_test_utils::NavigateToURL(browser(), accessible_resource_with_csp);
+  ASSERT_TRUE(content::ExecuteJavaScriptAndExtractString(
+    chrome::GetActiveWebContents(browser())->GetRenderViewHost(), L"",
+      L"window.domAutomationController.send(document.title)",
+    &result));
+  EXPECT_EQ("Loaded", result);
+}
+
 IN_PROC_BROWSER_TEST_F(ExtensionResourceRequestPolicyTest, Iframe) {
   // Load another extension, which the test one shouldn't be able to get
   // resources from.
   ASSERT_TRUE(LoadExtension(test_data_dir_
       .AppendASCII("extension_resource_request_policy")
       .AppendASCII("inaccessible")));
   EXPECT_TRUE(RunExtensionSubtest(
       "extension_resource_request_policy/web_accessible",
       "iframe.html"));
 }
 
 #if defined(OS_MACOSX)
 #define MAYBE_ExtensionAccessibleResources FLAKY_ExtensionAccessibleResources
 #else
 #define MAYBE_ExtensionAccessibleResources ExtensionAccessibleResources
 #endif
 IN_PROC_BROWSER_TEST_F(ExtensionResourceRequestPolicyTest,
                        MAYBE_ExtensionAccessibleResources) {
   ASSERT_TRUE(RunExtensionSubtest("accessible_cer", "main.html")) << message_;
 }