Adding 'blob:' and 'filesystem:' URLs as secure sources for extensions.

chrome/common/extensions/csp_validator_unittest.cc

Index: chrome/common/extensions/csp_validator_unittest.cc
diff --git a/chrome/common/extensions/csp_validator_unittest.cc b/chrome/common/extensions/csp_validator_unittest.cc
index 4caab6d6f3bb6329e7986dcd6698f834c432e9b9..3997ef8b73b398072512cd14a4f35c433540df23 100644
--- a/chrome/common/extensions/csp_validator_unittest.cc
+++ b/chrome/common/extensions/csp_validator_unittest.cc
@@ -91,6 +91,15 @@ TEST(ExtensionCSPValidator, IsSecure) {
       "default-src 'self' http://127.0.0.1.example.com"));
   EXPECT_FALSE(ContentSecurityPolicyIsSecure(
       "default-src 'self' http://localhost.example.com"));
+
+  EXPECT_TRUE(ContentSecurityPolicyIsSecure(
+      "default-src 'self' blob:"));
+  EXPECT_TRUE(ContentSecurityPolicyIsSecure(
+      "default-src 'self' blob:http://example.com/XXX"));

[abarth-chromium, 2012/08/24 14:55:00]

I would EXPECT_FALSE here.  You can't load cross-origin blob URLs anyway.

[Mike West, 2012/08/24 15:13:36]

I can certainly change it to only accept the protocol-only source. I think
you're right; that's really all that makes sense.

+  EXPECT_TRUE(ContentSecurityPolicyIsSecure(
+      "default-src 'self' filesystem:"));
+  EXPECT_TRUE(ContentSecurityPolicyIsSecure(
+      "default-src 'self' filesystem:http://example.com/XXX"));

[abarth-chromium, 2012/08/24 14:55:00]

Same for filesystem.

 }
 
 TEST(ExtensionCSPValidator, IsSandboxed) {