Apply content-security-policy to the HTML options page. This is a

chrome/common/jstemplate_builder.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // A helper function for using JsTemplate. See jstemplate_builder.h for more
 // info.
 
 #include "chrome/common/jstemplate_builder.h"
 
 #include "base/logging.h"
@@ skipping 29 matching lines @@
   std::string output(html_template.data(), html_template.size());
   AppendI18nTemplateSourceHtml(&output);
   AppendJsTemplateSourceHtml(&output);
   AppendJsonHtml(json, &output);
   AppendI18nTemplateProcessHtml(&output);
   AppendJsTemplateProcessHtml(template_id, &output);
   return output;
 }
 
 void AppendJsonHtml(const DictionaryValue* json, std::string* output) {
+  output->append("<script>");
+  AppendJsonJS(json, output);
+  output->append("</script>");
+}
+
+void AppendJsonJS(const DictionaryValue* json, std::string* output) {
   // Convert the template data to a json string.
   DCHECK(json) << "must include json data structure";
 
   std::string jstext;
   JSONStringValueSerializer serializer(&jstext);
   serializer.Serialize(*json);
   // </ confuses the HTML parser because it could be a </script> tag.  So we
   // replace </ with <\/.  The extra \ will be ignored by the JS engine.
   ReplaceSubstringsAfterOffset(&jstext, 0, "</", "<\\/");

[abarth-chromium, 2011/05/10 21:11:45]

This escaping actually isn't allowed in JSON.  This isn't really JSON, it's
JavaScript (especially with the var declaration).

 
-  output->append("<script>");
   output->append("var templateData = ");
   output->append(jstext);
   output->append(";");
-  output->append("</script>");
 }
 
 void AppendJsTemplateSourceHtml(std::string* output) {
   // fetch and cache the pointer of the jstemplate resource source text.
   static const base::StringPiece jstemplate_src(
       ResourceBundle::GetSharedInstance().GetRawDataResource(
           IDR_JSTEMPLATE_JS));
 
   if (jstemplate_src.empty()) {
     NOTREACHED() << "Unable to get jstemplate src";
@@ skipping 25 matching lines @@
     NOTREACHED() << "Unable to get i18n template src";
     return;
   }
 
   output->append("<script>");
   output->append(i18n_template_src.data(), i18n_template_src.size());
   output->append("</script>");
 }
 
 void AppendI18nTemplateProcessHtml(std::string* output) {
+  static const base::StringPiece i18n_process_src(
+      ResourceBundle::GetSharedInstance().GetRawDataResource(
+          IDR_I18N_PROCESS_JS));
+
+  if (i18n_process_src.empty()) {
+    NOTREACHED() << "Unable to get i18n process src";
+    return;
+  }
+
   output->append("<script>");
-  output->append("i18nTemplate.process(document, templateData);");
+  output->append(i18n_process_src.data(), i18n_process_src.size());
   output->append("</script>");
 }
 
 }  // namespace jstemplate_builder