Adding content_security_policy to sample extensions when relevant.

Adding content_security_policy to sample extensions when relevant.

BUG=92644
TEST=

[Mike West, 2011-08-12 13:26:09]

Hi Kathy, Erik,

I've done a quick pass over the example extensions, adding a flat
`content_security_policy: default_src 'self'` to most, and whitelisting a few
domains for others (analytics, docs/gmail integration, etc).

Before I dive in and start installing each to make sure they still work (which
might take a little while), I'd like to make sure this is something that's
reasonable to do. I think it's something we want to encourage, but I'd like your
feedback.

Thanks!

-Mike

[abarth-chromium, 2011-08-12 22:07:59]

http://codereview.chromium.org/7633017/diff/1/chrome/common/extensions/docs/e...
File
chrome/common/extensions/docs/examples/api/omnibox/extension-docs/manifest.json
(right):

http://codereview.chromium.org/7633017/diff/1/chrome/common/extensions/docs/e...
chrome/common/extensions/docs/examples/api/omnibox/extension-docs/manifest.json:15:
"content_security_policy": "default-src 'self' http://src.chromium.org"
What sort of resources does this extension load from src.chromium.org?  We
should break them out explicitly rather than lumping them into default-src.

http://codereview.chromium.org/7633017/diff/1/chrome/common/extensions/docs/e...
File chrome/common/extensions/docs/examples/extensions/buildbot/manifest.json
(right):

http://codereview.chromium.org/7633017/diff/1/chrome/common/extensions/docs/e...
chrome/common/extensions/docs/examples/extensions/buildbot/manifest.json:18:
"content_security_policy": "default-src 'self' http://build.chromium.org
http://chromium-status.appspot.com"
Same question here.

http://codereview.chromium.org/7633017/diff/1/chrome/common/extensions/docs/e...
File chrome/common/extensions/docs/examples/extensions/calendar/manifest.json
(right):

http://codereview.chromium.org/7633017/diff/1/chrome/common/extensions/docs/e...
chrome/common/extensions/docs/examples/extensions/calendar/manifest.json:18:
"content_security_policy": "default-src 'self' *.google.com"
I doubt this does what you want.  You probably want to include a scheme,
otherwise it will inherit the chrome-extension scheme.  (Also, you should break
out the types of resources.)

http://codereview.chromium.org/7633017/diff/1/chrome/common/extensions/docs/e...
File
chrome/common/extensions/docs/examples/extensions/email_this_page/manifest.json
(right):

http://codereview.chromium.org/7633017/diff/1/chrome/common/extensions/docs/e...
chrome/common/extensions/docs/examples/extensions/email_this_page/manifest.json:15:
"content_security_policy": "default-src 'self' https://mail.google.com"
Types of resources?

[Mike West, 2011-08-19 09:58:04]

Thanks Adam. I appreciate the comments, and I'll certainly do my best to apply
policy more granularly than `default-src` once I dive into the individual
extension testing.

As it turns out, this will be a bit more busywork than I expected, as I'll also
need to extract the mostly-inline JavaScript out into separate files. I haven't
had a chance this week to do that, but I'll have some down time on a plane
Monday that might work. :)

@Kathy, do you see any issue from a documentation perspective if I change our
sample code from HTML files containing direct <script> blocks to HTML files
linking off to separate JavaScript files? I think we want to encourage that
practice anyway, but I'd like your OK before I dive in. :)

-Mike

[kathyw, 2011-08-19 15:14:53]

On 2011/08/19 09:58:04, Mike West wrote:
> ...
> @Kathy, do you see any issue from a documentation perspective if I change our
> sample code from HTML files containing direct <script> blocks to HTML files
> linking off to separate JavaScript files? I think we want to encourage that
> practice anyway, but I'd like your OK before I dive in. :)

You have my blessing. :)

I've added Boris to the cc list, since he's been thinking about
content_security_policy and samples.

-k-

[Mike West, 2011-10-14 12:13:52]

This turned out to be a lot more busywork than I expected. :)

I'm throwing this CL away, and will be proceeding with smus@ on a
sample-by-sample basis rather than trying to do everything in a big bang. 

http://codereview.chromium.org/8273036/ is the first of lots.