Replace <meta> tag with header for content-security-policy on chrome:// pages.

chrome/browser/ui/webui/chrome_url_data_manager_backend.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/chrome_url_data_manager_backend.h"
 
+#include <set>
+
 #include "base/basictypes.h"
 #include "base/command_line.h"
 #include "base/compiler_specific.h"
 #include "base/file_util.h"
+#include "base/lazy_instance.h"
 #include "base/memory/ref_counted_memory.h"
 #include "base/message_loop.h"
 #include "base/path_service.h"
 #include "base/string_util.h"
 #include "chrome/browser/net/chrome_url_request_context.h"
 #include "chrome/browser/net/view_blob_internals_job_factory.h"
 #include "chrome/browser/net/view_http_cache_job_factory.h"
 #include "chrome/browser/ui/webui/shared_resources_data_source.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/url_constants.h"
 #include "content/browser/appcache/chrome_appcache_service.h"
 #include "content/browser/browser_thread.h"
 #include "googleurl/src/url_util.h"
 #include "grit/platform_locale_settings.h"
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
 #include "net/http/http_response_headers.h"
 #include "net/url_request/url_request.h"
 #include "net/url_request/url_request_file_job.h"
 #include "net/url_request/url_request_job.h"
 #include "net/url_request/url_request_job_factory.h"
 #include "webkit/appcache/view_appcache_internals_job.h"
 
 namespace {
 
+// X-WebKit-CSP is our development name for Content-Security-Policy.
+// TODO(tsepez) rename when Content-security-policy is done.
+// TODO(tsepez) remove unsafe-eval when bidichecker_packaged.js fixed.
+// TODO(tsepez) chrome-extension: permits the ChromeVox screen reader
+//     extension to function on these pages.  Remove it when the extension
+//     is updated to stop injecting script into the pages.
+const char kChromeURLContentSecurityPolicyHeader[] =
+    "X-WebKit-CSP: object-src 'self'; script-src chrome://resources "
+    "chrome-extension://mndnfokpggljbaajbnioimlmbfngpief "
+    "'self' 'unsafe-eval'";
+
+class ChromeURLContentSecurityPolicyExceptionSet
+    : public std::set<std::string> {
+ public:
+  ChromeURLContentSecurityPolicyExceptionSet() : std::set<std::string>() {
+    insert(chrome::kChromeUICloudPrintResourcesHost);
+    insert(chrome::kChromeUICloudPrintSetupHost);
+    insert(chrome::kChromeUICreditsHost);
+    insert(chrome::kChromeUIDevToolsHost);
+    insert(chrome::kChromeUIDialogHost);
+    insert(chrome::kChromeUINewTabHost);
+    insert(chrome::kChromeUITextfieldsHost);
+#if defined(OS_CHROMEOS)
+    insert(chrome::kChromeUIActiveDownloadsHost);
+    insert(chrome::kChromeUIChooseMobileNetworkHost);
+    insert(chrome::kChromeUIEnterpriseEnrollmentHost);
+    insert(chrome::kChromeUIImageBurnerHost);
+    insert(chrome::kChromeUIKeyboardOverlayHost);
+    insert(chrome::kChromeUIOobeHost);
+    insert(chrome::kChromeUIMobileSetupHost);
+    insert(chrome::kChromeUIProxySettingsHost);
+    insert(chrome::kChromeUIRegisterPageHost);
+    insert(chrome::kChromeUISimUnlockHost);
+    insert(chrome::kChromeUISystemInfoHost);
+#else
+    insert(chrome::kChromeUISyncPromoHost);
+#endif
+#if defined(TOUCH_UI)
+    insert(chrome::kChromeUIKeyboardHost);
+#endif
+#if defined(OS_CHROMEOS) || defined(TOUCH_UI)
+    insert(chrome::kChromeUICollectedCookiesHost);
+    insert(chrome::kChromeUIHttpAuthHost);
+    insert(chrome::kChromeUIRepostFormWarningHost);
+#endif
+  }
+};
+
+base::LazyInstance<ChromeURLContentSecurityPolicyExceptionSet>
+    g_chrome_url_content_security_policy_exceptions(base::LINKER_INITIALIZED);
+
 // Parse a URL into the components used to resolve its request. |source_name|
 // is the hostname and |path| is the remaining portion of the URL.
 void URLToRequest(const GURL& url, std::string* source_name,
                   std::string* path) {
   DCHECK(url.SchemeIs(chrome::kChromeDevToolsScheme) ||
          url.SchemeIs(chrome::kChromeUIScheme));
 
   if (!url.is_valid()) {
     NOTREACHED();
     return;
@@ skipping 101 matching lines @@
   *mime_type = mime_type_;
   return !mime_type_.empty();
 }
 
 void URLRequestChromeJob::GetResponseInfo(net::HttpResponseInfo* info) {
   DCHECK(!info->headers);
   // Set the headers so that requests serviced by ChromeURLDataManager return a
   // status code of 200. Without this they return a 0, which makes the status
   // indistiguishable from other error types. Instant relies on getting a 200.
   info->headers = new net::HttpResponseHeaders("HTTP/1.1 200 OK");
+  ChromeURLContentSecurityPolicyExceptionSet* exceptions =
+      g_chrome_url_content_security_policy_exceptions.Pointer();
+  if (exceptions->find(request_->url().host()) == exceptions->end())
+    info->headers->AddHeader(kChromeURLContentSecurityPolicyHeader);
 }
 
 void URLRequestChromeJob::DataAvailable(RefCountedMemory* bytes) {
   if (bytes) {
     // The request completed, and we have all the data.
     // Clear any IO pending status.
     SetStatus(net::URLRequestStatus());
 
     data_ = bytes;
     int bytes_read;
@@ skipping 321 matching lines @@
 
   return new URLRequestChromeJob(request, backend_);
 }
 
 }  // namespace
 
 net::URLRequestJobFactory::ProtocolHandler*
 CreateDevToolsProtocolHandler(ChromeURLDataManagerBackend* backend) {
   return new DevToolsJobFactory(backend);
 }