Whitelisting `127.0.0.1` and `localhost` for HTTP in extensions' CSP.

chrome/common/extensions/csp_validator_unittest.cc

Index: chrome/common/extensions/csp_validator_unittest.cc
diff --git a/chrome/common/extensions/csp_validator_unittest.cc b/chrome/common/extensions/csp_validator_unittest.cc
index 33c3deb164e650095f0608b9457318793b514fa1..6e612403480fb14f4d86a65a32239e9e8909d0a2 100644
--- a/chrome/common/extensions/csp_validator_unittest.cc
+++ b/chrome/common/extensions/csp_validator_unittest.cc
@@ -76,6 +76,15 @@ TEST(ExtensionCSPValidator, IsSecure) {
       "default-src 'self' google.com"));
   EXPECT_TRUE(ContentSecurityPolicyIsSecure(
       "default-src 'self' https://*.google.com"));
+
+  EXPECT_TRUE(ContentSecurityPolicyIsSecure(
+      "default-src 'self' http://127.0.0.1"));
+  EXPECT_TRUE(ContentSecurityPolicyIsSecure(
+      "default-src 'self' http://localhost"));
+  EXPECT_FALSE(ContentSecurityPolicyIsSecure(
+      "default-src 'self' http://127.0.0.1.example.com"));
+  EXPECT_FALSE(ContentSecurityPolicyIsSecure(
+      "default-src 'self' http://localhost.example.com"));
 }
 
 TEST(ExtensionCSPValidator, IsSandboxed) {