Apply content-security-policy to the HTML options page. This is a

chrome/browser/ui/webui/options/options_ui.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/options/options_ui.h"
 
 #include <algorithm>
 #include <vector>
 
 #include "base/callback.h"
@@ skipping 26 matching lines @@
 #include "chrome/browser/ui/webui/theme_source.h"
 #include "chrome/common/jstemplate_builder.h"
 #include "chrome/common/time_format.h"
 #include "chrome/common/url_constants.h"
 #include "content/browser/browser_thread.h"
 #include "content/browser/renderer_host/render_view_host.h"
 #include "content/browser/tab_contents/tab_contents.h"
 #include "content/browser/tab_contents/tab_contents_delegate.h"
 #include "content/browser/user_metrics.h"
 #include "content/common/notification_type.h"
-#include "grit/browser_resources.h"
 #include "grit/chromium_strings.h"
 #include "grit/generated_resources.h"
 #include "grit/locale_settings.h"
+#include "grit/options_resources.h"
 #include "grit/theme_resources.h"
 #include "net/base/escape.h"
 #include "ui/base/resource/resource_bundle.h"
 
 #if defined(OS_CHROMEOS)
 #include "chrome/browser/ui/webui/options/chromeos/accounts_options_handler.h"
 #include "chrome/browser/ui/webui/options/chromeos/change_picture_options_handler.h"
 #include "chrome/browser/ui/webui/options/chromeos/core_chromeos_options_handler.h"
 #include "chrome/browser/ui/webui/options/chromeos/cros_language_options_handler.h"
 #include "chrome/browser/ui/webui/options/chromeos/internet_options_handler.h"
 #include "chrome/browser/ui/webui/options/chromeos/language_chewing_handler.h"
 #include "chrome/browser/ui/webui/options/chromeos/language_customize_modifier_keys_handler.h"
 #include "chrome/browser/ui/webui/options/chromeos/language_hangul_handler.h"
 #include "chrome/browser/ui/webui/options/chromeos/language_mozc_handler.h"
 #include "chrome/browser/ui/webui/options/chromeos/language_pinyin_handler.h"
 #include "chrome/browser/ui/webui/options/chromeos/proxy_handler.h"
 #include "chrome/browser/ui/webui/options/chromeos/stats_options_handler.h"
 #include "chrome/browser/ui/webui/options/chromeos/system_options_handler.h"
 #include "chrome/browser/ui/webui/options/chromeos/user_image_source.h"
 #endif
 
 #if defined(USE_NSS)
 #include "chrome/browser/ui/webui/options/certificate_manager_handler.h"
 #endif
 
+static const char kLocalizedStringsFile[] = "strings.js";
+static const char kOptionsBundleJsFile[]  = "options_bundle.js";
+
 ////////////////////////////////////////////////////////////////////////////////
 //
 // OptionsUIHTMLSource
 //
 ////////////////////////////////////////////////////////////////////////////////
 
 class OptionsUIHTMLSource : public ChromeURLDataManager::DataSource {
  public:
   // The constructor takes over ownership of |localized_strings|.
   explicit OptionsUIHTMLSource(DictionaryValue* localized_strings);
@@ skipping 17 matching lines @@
     : DataSource(chrome::kChromeUISettingsHost, MessageLoop::current()) {
   DCHECK(localized_strings);
   localized_strings_.reset(localized_strings);
 }
 
 OptionsUIHTMLSource::~OptionsUIHTMLSource() {}
 
 void OptionsUIHTMLSource::StartDataRequest(const std::string& path,
                                            bool is_incognito,
                                            int request_id) {
+  scoped_refptr<RefCountedBytes> response_bytes(new RefCountedBytes);
   SetFontAndTextDirection(localized_strings_.get());
 
-  static const base::StringPiece options_html(
-      ResourceBundle::GetSharedInstance().GetRawDataResource(
-          IDR_OPTIONS_HTML));
-  const std::string full_html = jstemplate_builder::GetI18nTemplateHtml(
-      options_html, localized_strings_.get());
+  if (path == kLocalizedStringsFile) {
+    // Return dynamically-generated strings from memory.
+    std::string template_data;
+    jstemplate_builder::AppendJsonJS(localized_strings_.get(), &template_data);
+    response_bytes->data.resize(template_data.size());
+    std::copy(template_data.begin(),
+              template_data.end(),
+              response_bytes->data.begin());
+  } else if (path == kOptionsBundleJsFile) {
+    // Return (and cache) the options javascript code.
+    static const base::StringPiece options_javascript(
+        ResourceBundle::GetSharedInstance().GetRawDataResource(
+            IDR_OPTIONS_BUNDLE_JS));
+    response_bytes->data.resize(options_javascript.size());
+    std::copy(options_javascript.begin(),
+              options_javascript.end(),
+              response_bytes->data.begin());
+  } else {
+    // Return (and cache) the main options html page as the default.
+    static const base::StringPiece options_html(
+        ResourceBundle::GetSharedInstance().GetRawDataResource(
+            IDR_OPTIONS_HTML));
+    response_bytes->data.resize(options_html.size());
+    std::copy(options_html.begin(),
+              options_html.end(),
+              response_bytes->data.begin());
+  }
 
-  scoped_refptr<RefCountedBytes> html_bytes(new RefCountedBytes);
-  html_bytes->data.resize(full_html.size());
-  std::copy(full_html.begin(), full_html.end(), html_bytes->data.begin());
-
-  SendResponse(request_id, html_bytes);
+  SendResponse(request_id, response_bytes);
 }
 
-std::string OptionsUIHTMLSource::GetMimeType(const std::string&) const {
+std::string OptionsUIHTMLSource::GetMimeType(const std::string& path) const {
+  if (path == kLocalizedStringsFile || path == kOptionsBundleJsFile)
+    return "application/javascript";
+
   return "text/html";
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 //
 // OptionsPageUIHandler
 //
 ////////////////////////////////////////////////////////////////////////////////
 
 OptionsPageUIHandler::OptionsPageUIHandler() {
@@ skipping 186 matching lines @@
                                         OptionsPageUIHandler* handler_raw) {
   scoped_ptr<OptionsPageUIHandler> handler(handler_raw);
   DCHECK(handler.get());
   // Add only if handler's service is enabled.
   if (handler->IsEnabled()) {
     handler->GetLocalizedValues(localized_strings);
     // Add handler to the list and also pass the ownership.
     AddMessageHandler(handler.release()->Attach(this));
   }
 }