Tweaking the "insecure CSP" error message to clarify that both 'script-src' and 'object-src' must b…

chrome/common/extensions/extension_manifest_constants.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/extensions/extension_manifest_constants.h"
 
 namespace extension_manifest_keys {
 
 const char kAllFrames[] = "all_frames";
 const char kAltKey[] = "altKey";
@@ skipping 439 matching lines @@
     "Invalid value for 'web_accessible_resources'.";
 const char kInvalidWebAccessibleResource[] =
     "Invalid value for 'web_accessible_resources[*]'.";
 const char kInvalidWebURL[] =
     "Invalid value for 'app.urls[*]': *";
 const char kInvalidWebURLs[] =
     "Invalid value for 'app.urls'.";
 const char kInvalidZipHash[] =
     "Required key 'zip_hash' is missing or invalid.";
 const char kInsecureContentSecurityPolicy[] =
-    "Invalid value for 'content_security_policy': The 'script-src' and"
-    " 'object-src' directives can only whitelist secure resources. You may"
-    " include any of the following sources: \"'self'\", \"http://127.0.0.1\","
-    " \"http://localhost\", or any \"https://\" or \"chrome-extension://\""
-    " origin. For more information, see"
+    "Invalid value for 'content_security_policy': Both 'script-src' and"
+    " 'object-src' directives must be specified (either explicitly, or"
+    " implicitly via 'default-src'), and both must whitelist only secure"
+    " resources. You may include any of the following sources: \"'self'\","
+    " \"http://127.0.0.1\", \"http://localhost\", or any \"https://\" or"
+    " \"chrome-extension://\" origin. For more information, see"

[Aaron Boodman, 2012/09/13 15:53:36]

You can whitelist unsafe-eval too, right?

     " http://developer.chrome.com/extensions/contentSecurityPolicy.html";
 const char kLaunchPathAndExtentAreExclusive[] =
     "The 'app.launch.local_path' and 'app.urls' keys cannot both be set.";
 const char kLaunchPathAndURLAreExclusive[] =
     "The 'app.launch.local_path' and 'app.launch.web_url' keys cannot "
     "both be set.";
 const char kLaunchURLRequired[] =
     "Either 'app.launch.local_path' or 'app.launch.web_url' is required.";
 const char kLocalesMessagesFileMissing[] =
     "Messages file is missing for locale.";
@@ skipping 31 matching lines @@
 const char kScriptBadgeTitleIgnored[] =
     "default_title specified in script_badge manifest section will not be "
     "used.";
 const char kWebRequestConflictsWithLazyBackground[] =
     "The 'webRequest' API cannot be used with event pages.";
 #if defined(OS_CHROMEOS)
 const char kIllegalPlugins[] =
     "Extensions cannot install plugins on Chrome OS";
 #endif
 }  // namespace extension_manifest_errors