Apply content-security-policy to the HTML options page. This is a

chrome/browser/ui/webui/options/options_ui.cc

Index: chrome/browser/ui/webui/options/options_ui.cc
===================================================================
--- chrome/browser/ui/webui/options/options_ui.cc	(revision 84688)
+++ chrome/browser/ui/webui/options/options_ui.cc	(working copy)
@@ -110,22 +110,34 @@
 void OptionsUIHTMLSource::StartDataRequest(const std::string& path,
                                            bool is_incognito,
                                            int request_id) {
+  scoped_refptr<RefCountedBytes> html_bytes(new RefCountedBytes);

[abarth-chromium, 2011/05/10 21:11:45]

It seems odd to call this html_bytes because sometimes it's JavaScript.  Maybe
response_bytes ?

   SetFontAndTextDirection(localized_strings_.get());
 
-  static const base::StringPiece options_html(
-      ResourceBundle::GetSharedInstance().GetRawDataResource(
-          IDR_OPTIONS_HTML));
-  const std::string full_html = jstemplate_builder::GetI18nTemplateHtml(
-      options_html, localized_strings_.get());
+  if (path == "strings")

[abarth-chromium, 2011/05/10 21:11:45]

I'm not sure whether this is the best name.  Maybe strings.json ?

+  {

[abarth-chromium, 2011/05/10 21:11:45]

This { should be on the previous line per the style guide.

+    std::string template_data;
+    jstemplate_builder::AppendJsonJS(localized_strings_.get(), &template_data);
+    html_bytes->data.resize(template_data.size());
+    std::copy(template_data.begin(),
+              template_data.end(),
+              html_bytes->data.begin());
+  } else {
+    static const base::StringPiece options_html(
+        ResourceBundle::GetSharedInstance().GetRawDataResource(
+            IDR_OPTIONS_HTML));
+    html_bytes->data.resize(options_html.size());
+    std::copy(options_html.begin(),
+              options_html.end(),
+              html_bytes->data.begin());
+  }
 
-  scoped_refptr<RefCountedBytes> html_bytes(new RefCountedBytes);
-  html_bytes->data.resize(full_html.size());
-  std::copy(full_html.begin(), full_html.end(), html_bytes->data.begin());
-
   SendResponse(request_id, html_bytes);
 }
 
-std::string OptionsUIHTMLSource::GetMimeType(const std::string&) const {
+std::string OptionsUIHTMLSource::GetMimeType(const std::string& path) const {
+  if (path == "strings")

[abarth-chromium, 2011/05/10 21:11:45]

This string appears twice.  Maybe make it a named constant at the top of the
file?

+    return "application/javascript";
+
   return "text/html";
 }