Adding 'blob:' and 'filesystem:' URLs as secure sources for extensions.

chrome/common/extensions/csp_validator_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/extensions/csp_validator.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 using extensions::csp_validator::ContentSecurityPolicyIsLegal;
 using extensions::csp_validator::ContentSecurityPolicyIsSecure;
 using extensions::csp_validator::ContentSecurityPolicyIsSandboxed;
@@ skipping 73 matching lines @@
   EXPECT_TRUE(ContentSecurityPolicyIsSecure(
       "default-src 'self' http://lOcAlHoSt"));
   EXPECT_TRUE(ContentSecurityPolicyIsSecure(
       "default-src 'self' http://127.0.0.1:9999"));
   EXPECT_TRUE(ContentSecurityPolicyIsSecure(
       "default-src 'self' http://localhost:8888"));
   EXPECT_FALSE(ContentSecurityPolicyIsSecure(
       "default-src 'self' http://127.0.0.1.example.com"));
   EXPECT_FALSE(ContentSecurityPolicyIsSecure(
       "default-src 'self' http://localhost.example.com"));
+
+  EXPECT_TRUE(ContentSecurityPolicyIsSecure(
+      "default-src 'self' blob:"));
+  EXPECT_TRUE(ContentSecurityPolicyIsSecure(
+      "default-src 'self' blob:http://example.com/XXX"));

[abarth-chromium, 2012/08/24 14:55:00]

I would EXPECT_FALSE here.  You can't load cross-origin blob URLs anyway.

[Mike West, 2012/08/24 15:13:36]

I can certainly change it to only accept the protocol-only source. I think
you're right; that's really all that makes sense.

+  EXPECT_TRUE(ContentSecurityPolicyIsSecure(
+      "default-src 'self' filesystem:"));
+  EXPECT_TRUE(ContentSecurityPolicyIsSecure(
+      "default-src 'self' filesystem:http://example.com/XXX"));

[abarth-chromium, 2012/08/24 14:55:00]

Same for filesystem.

 }
 
 TEST(ExtensionCSPValidator, IsSandboxed) {
   EXPECT_FALSE(ContentSecurityPolicyIsSandboxed("", Extension::TYPE_EXTENSION));
   EXPECT_FALSE(ContentSecurityPolicyIsSandboxed(
       "img-src https://google.com", Extension::TYPE_EXTENSION));
 
   // Sandbox directive is required.
   EXPECT_TRUE(ContentSecurityPolicyIsSandboxed(
       "sandbox", Extension::TYPE_EXTENSION));
@@ skipping 12 matching lines @@
   // Extensions allow navigation and popups, platform apps don't.
   EXPECT_TRUE(ContentSecurityPolicyIsSandboxed(
       "sandbox allow-top-navigation", Extension::TYPE_EXTENSION));
   EXPECT_FALSE(ContentSecurityPolicyIsSandboxed(
       "sandbox allow-top-navigation", Extension::TYPE_PLATFORM_APP));
   EXPECT_TRUE(ContentSecurityPolicyIsSandboxed(
       "sandbox allow-popups", Extension::TYPE_EXTENSION));
   EXPECT_FALSE(ContentSecurityPolicyIsSandboxed(
       "sandbox allow-popups", Extension::TYPE_PLATFORM_APP));
 }