Apply content-security-policy directive to chrome://workers page.

chrome/browser/ui/webui/chrome_web_ui_data_source.cc

Index: chrome/browser/ui/webui/chrome_web_ui_data_source.cc
===================================================================
--- chrome/browser/ui/webui/chrome_web_ui_data_source.cc	(revision 97885)
+++ chrome/browser/ui/webui/chrome_web_ui_data_source.cc	(working copy)
@@ -14,8 +14,15 @@
 
 ChromeWebUIDataSource::ChromeWebUIDataSource(const std::string& source_name)
     : DataSource(source_name, MessageLoop::current()),
-      default_resource_(-1) {}
+      default_resource_(-1) {
+}
 
+ChromeWebUIDataSource::ChromeWebUIDataSource(const std::string& source_name,
+                                             MessageLoop* loop)
+    : DataSource(source_name, loop),
+      default_resource_(-1) {
+}
+
 ChromeWebUIDataSource::~ChromeWebUIDataSource() {
 }
 
@@ -33,6 +40,9 @@
   if (EndsWith(path, ".js", false))
     return "application/javascript";
 
+  if (EndsWith(path, ".json", false))
+    return "application/json";
+
   if (EndsWith(path, ".pdf", false))
     return "application/pdf";
 
@@ -42,7 +52,7 @@
 void ChromeWebUIDataSource::StartDataRequest(const std::string& path,
                                              bool is_incognito,
                                              int request_id) {
-  if (path == json_path_) {
+  if (!json_path_.empty() && path == json_path_) {

[Evan Stade, 2011/08/24 20:47:23]

I think it would be perhaps clearer to instead do

DCHECK(!path.empty())

at the start of the function (I think that's equivalent).

[Tom Sepez, 2011/08/24 20:52:36]

Not quite.  json_path_ can be empty if the particular source doesn't have any
json to return, and thus hasn't called set_json_path().  We don't want to take
this path unless the json_path has been set.

     SendLocalizedStringsAsJSON(request_id);
   } else {
     int resource_id = default_resource_;