Apply content-security-policy to the HTML options page. This is a

chrome/common/jstemplate_builder.cc

Index: chrome/common/jstemplate_builder.cc
===================================================================
--- chrome/common/jstemplate_builder.cc	(revision 84688)
+++ chrome/common/jstemplate_builder.cc	(working copy)
@@ -47,6 +47,12 @@
 }
 
 void AppendJsonHtml(const DictionaryValue* json, std::string* output) {
+  output->append("<script>");
+  AppendJsonJS(json, output);
+  output->append("</script>");
+}
+
+void AppendJsonJS(const DictionaryValue* json, std::string* output) {
   // Convert the template data to a json string.
   DCHECK(json) << "must include json data structure";
 
@@ -57,11 +63,9 @@
   // replace </ with <\/.  The extra \ will be ignored by the JS engine.
   ReplaceSubstringsAfterOffset(&jstext, 0, "</", "<\\/");

[abarth-chromium, 2011/05/10 21:11:45]

This escaping actually isn't allowed in JSON.  This isn't really JSON, it's
JavaScript (especially with the var declaration).

 
-  output->append("<script>");
   output->append("var templateData = ");
   output->append(jstext);
   output->append(";");
-  output->append("</script>");
 }
 
 void AppendJsTemplateSourceHtml(std::string* output) {
@@ -107,8 +111,17 @@
 }
 
 void AppendI18nTemplateProcessHtml(std::string* output) {
+  static const base::StringPiece i18n_process_src(
+      ResourceBundle::GetSharedInstance().GetRawDataResource(
+          IDR_I18N_PROCESS_JS));
+
+  if (i18n_process_src.empty()) {
+    NOTREACHED() << "Unable to get i18n process src";
+    return;
+  }
+
   output->append("<script>");
-  output->append("i18nTemplate.process(document, templateData);");
+  output->append(i18n_process_src.data(), i18n_process_src.size());
   output->append("</script>");
 }