Adding `content_security_policy` to imageinfo extension.

Adding `content_security_policy` to imageinfo extension.

BUG=92644
TEST=

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=105725

[Mike West, 2011-10-15 18:00:02]

I'd like to restrict this extension a bit more, but I don't think I can, as it
needs to read image data from pretty much everywhere.

Can you two give it a quick review?

Thanks!

-Mike

[abarth-chromium, 2011-10-15 18:23:12]

http://codereview.chromium.org/8310002/diff/1/chrome/common/extensions/docs/e...
File chrome/common/extensions/docs/examples/extensions/imageinfo/background.html
(right):

http://codereview.chromium.org/8310002/diff/1/chrome/common/extensions/docs/e...
chrome/common/extensions/docs/examples/extensions/imageinfo/background.html:12:
<script src="./background.js"></script>
why ./background rather than just background.js ?

http://codereview.chromium.org/8310002/diff/1/chrome/common/extensions/docs/e...
File chrome/common/extensions/docs/examples/extensions/imageinfo/info.html
(right):

http://codereview.chromium.org/8310002/diff/1/chrome/common/extensions/docs/e...
chrome/common/extensions/docs/examples/extensions/imageinfo/info.html:13:
<script src="./info.js"></script>
Same questions here.

http://codereview.chromium.org/8310002/diff/1/chrome/common/extensions/docs/e...
File chrome/common/extensions/docs/examples/extensions/imageinfo/manifest.json
(right):

http://codereview.chromium.org/8310002/diff/1/chrome/common/extensions/docs/e...
chrome/common/extensions/docs/examples/extensions/imageinfo/manifest.json:18:
"content_security_policy": "default-src 'self'; connect-src
talkingpointsmemo.com"
When you just specify a host name like you've done in connect-src, that inherits
the current scheme, which is chrome-extension.  You probably want to put the
http and https schemes explicitly.

[abarth-chromium, 2011-10-15 18:24:43]

http://codereview.chromium.org/8310002/diff/1/chrome/common/extensions/docs/e...
File chrome/common/extensions/docs/examples/extensions/imageinfo/manifest.json
(right):

http://codereview.chromium.org/8310002/diff/1/chrome/common/extensions/docs/e...
chrome/common/extensions/docs/examples/extensions/imageinfo/manifest.json:18:
"content_security_policy": "default-src 'self'; connect-src
talkingpointsmemo.com"
Maybe this is the wrong CSP policy?  I don't really see any references to
talkingpointsmemo in the extension and I'd expect something like img-src *.

[Use mkwst_at_chromium.org plz., 2011-10-15 18:41:26]

Thanks. Let's try this again. :)

http://codereview.chromium.org/8310002/diff/1/chrome/common/extensions/docs/e...
File chrome/common/extensions/docs/examples/extensions/imageinfo/background.html
(right):

http://codereview.chromium.org/8310002/diff/1/chrome/common/extensions/docs/e...
chrome/common/extensions/docs/examples/extensions/imageinfo/background.html:12:
<script src="./background.js"></script>
On 2011/10/15 18:23:12, abarth wrote:
> why ./background rather than just background.js ?

Done.

http://codereview.chromium.org/8310002/diff/1/chrome/common/extensions/docs/e...
File chrome/common/extensions/docs/examples/extensions/imageinfo/info.html
(right):

http://codereview.chromium.org/8310002/diff/1/chrome/common/extensions/docs/e...
chrome/common/extensions/docs/examples/extensions/imageinfo/info.html:13:
<script src="./info.js"></script>
On 2011/10/15 18:23:12, abarth wrote:
> Same questions here.

Done.

http://codereview.chromium.org/8310002/diff/1/chrome/common/extensions/docs/e...
File chrome/common/extensions/docs/examples/extensions/imageinfo/manifest.json
(right):

http://codereview.chromium.org/8310002/diff/1/chrome/common/extensions/docs/e...
chrome/common/extensions/docs/examples/extensions/imageinfo/manifest.json:18:
"content_security_policy": "default-src 'self'; connect-src
talkingpointsmemo.com"
On 2011/10/15 18:24:44, abarth wrote:
> Maybe this is the wrong CSP policy?  I don't really see any references to
> talkingpointsmemo in the extension and I'd expect something like img-src *.

I uploaded the wrong patch. :)  I was experimenting on that website to test
things.

[abarth-chromium, 2011-10-15 19:36:18]

lgtm