Add schema chrome-extension-resource:// for extension resources

chrome/common/extensions/csp_validator.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/extensions/csp_validator.h"
 
 #include "base/string_split.h"
 #include "base/string_tokenizer.h"
 #include "base/string_util.h"
 
@@ skipping 25 matching lines @@
     StringToLowerASCII(&source);
 
     if (EndsWith(source, "*", true))
       return false;
 
     // We might need to relax this whitelist over time.
     if (source == "'self'" ||
         source == "'none'" ||
         StartsWithASCII(source, "https://", true) ||
         StartsWithASCII(source, "chrome://", true) ||
-        StartsWithASCII(source, "chrome-extension://", true)) {
+        StartsWithASCII(source, "chrome-extension://", true) ||
+        StartsWithASCII(source, "chrome-extension-resource:", true)) {

[Aaron Boodman, 2012/04/18 17:52:24]

Why not "//" here too?

[Peng, 2012/04/18 18:29:16]

Because I tried "CER://" here and default CSP, it doesn't work.

       continue;

[Tom Sepez, 2012/04/18 18:03:01]

There has needed to be a comment here for some time.  There's some trickery
going on here to prevent wildcarding entire schemes.  CSP itself treats scheme:
and scheme:// differently.  The former is a wildcard for the entire scheme, the
latter is the specific URL with no other components and does not match any other
scheme: URL (I didn't write the spec). 

     }
 
     return false;
   }
 
   return true;  // Empty values default to 'none', which is secure.
 }
 
 // Returns true if |directive_name| matches |status.directive_name|.
 bool UpdateStatus(const std::string& directive_name,
@@ skipping 56 matching lines @@
            object_src_status.seen_in_policy;
   }
 
   return default_src_status.seen_in_policy ||
       (script_src_status.seen_in_policy && object_src_status.seen_in_policy);
 }
 
 }  // csp_validator
 
 }  // extensions