Enable CSP by default for extensions with manifest_version >= 2.

chrome/common/extensions/extension.cc

Index: chrome/common/extensions/extension.cc
===================================================================
--- chrome/common/extensions/extension.cc	(revision 110274)
+++ chrome/common/extensions/extension.cc	(working copy)
@@ -63,6 +63,9 @@
 
 const int kRSAKeySize = 1024;
 
+const char kDefaultContentSecurityPolicy[] =
+    "script-src 'self'; object-src 'self'";
+
 // Converts a normal hexadecimal string into the alphabet used by extensions.
 // We use the characters 'a'-'p' instead of '0'-'f' to avoid ever having a
 // completely numeric host, since some software interprets that as an IP
@@ -1275,7 +1278,8 @@
 }
 
 Extension::Extension(const FilePath& path, Location location)
-    : incognito_split_mode_(false),
+    : manifest_version_(0),
+      incognito_split_mode_(false),
       offline_enabled_(false),
       location_(location),
       converted_from_user_script_(false),
@@ -1454,6 +1458,19 @@
   optional_permission_set_ = new ExtensionPermissionSet();
   required_permission_set_ = new ExtensionPermissionSet();
 
+  if (source.HasKey(keys::kManifestVersion)) {
+    int manifest_version = 0;
+    if (!source.GetInteger(keys::kPublicKey, &manifest_version) ||
+        manifest_version < 1) {
+      *error = errors::kInvalidManifestVersion;
+      return false;
+    }
+    manifest_version_ = manifest_version;

[Aaron Boodman, 2011/11/17 07:10:15]

Should we do something about manifest version > 2 ?

+  } else {
+    // Version 1 was the original version, which lacked a version indicator.
+    manifest_version_ = 1;
+  }
+
   if (source.HasKey(keys::kPublicKey)) {
     std::string public_key_bytes;
     if (!source.GetString(keys::kPublicKey,
@@ -2217,6 +2234,11 @@
       return false;
     }
     content_security_policy_ = content_security_policy;
+  } else if (manifest_version_ >= 2) {
+    // Manifest version 2 introduced a default Content-Security-Policy.
+    // TODO(abarth): Should we continue to let extensions override the
+    //               default Content-Security-Policy?
+    content_security_policy_ = kDefaultContentSecurityPolicy;
   }
 
   // Initialize devtools page url (optional).