Whitelisting `127.0.0.1` and `localhost` for HTTP in extensions' CSP.

chrome/common/extensions/csp_validator.cc

Index: chrome/common/extensions/csp_validator.cc
diff --git a/chrome/common/extensions/csp_validator.cc b/chrome/common/extensions/csp_validator.cc
index a57bdb0ce9bbb3288d744dcf2c7da383d015ea7b..9138f5c9aef8c420331393603d23736c3422ca62 100644
--- a/chrome/common/extensions/csp_validator.cc
+++ b/chrome/common/extensions/csp_validator.cc
@@ -46,6 +46,10 @@ bool HasOnlySecureTokens(StringTokenizer& tokenizer) {
     // We might need to relax this whitelist over time.
     if (source == "'self'" ||
         source == "'none'" ||
+        source == "http://127.0.0.1" ||
+        LowerCaseEqualsASCII(source, "http://localhost") ||
+        StartsWithASCII(source, "http://127.0.0.1:", false) ||
+        StartsWithASCII(source, "http://localhost:", false) ||
         StartsWithASCII(source, "https://", true) ||
         StartsWithASCII(source, "chrome://", true) ||
         StartsWithASCII(source, "chrome-extension://", true) ||