Whitelisting `127.0.0.1` and `localhost` for HTTP in extensions' CSP.

chrome/common/extensions/csp_validator.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/extensions/csp_validator.h"
 
 #include "base/string_split.h"
 #include "base/string_tokenizer.h"
 #include "base/string_util.h"
 
@@ skipping 28 matching lines @@
   while (tokenizer.GetNext()) {
     std::string source = tokenizer.token();
     StringToLowerASCII(&source);
 
     if (EndsWith(source, "*", true))
       return false;
 
     // We might need to relax this whitelist over time.
     if (source == "'self'" ||
         source == "'none'" ||
+        source == "http://127.0.0.1" ||
+        source == "http://localhost" ||

[abarth-chromium, 2012/08/13 15:50:01]

This one should probably be case insensitive.

[abarth-chromium, 2012/08/13 15:50:42]

Do we want to allow non-default ports?  You might want:

StartsWithASCII("http://localhost:" as well.

         StartsWithASCII(source, "https://", true) ||
         StartsWithASCII(source, "chrome://", true) ||
         StartsWithASCII(source, "chrome-extension://", true) ||
         StartsWithASCII(source, "chrome-extension-resource:", true)) {
       continue;
     }
 
     return false;
   }
 
@@ skipping 103 matching lines @@
       }
     }
   }
 
   return seen_sandbox;
 }
 
 }  // csp_validator
 
 }  // extensions