Explicitly whitelist 'blob:' and 'filesystem:' in extensions' default CSP.

Explicitly whitelist 'blob:' and 'filesystem:' in extensions' default CSP.

'blob:' and 'filesystem:' should not match 'self' in CSP source
expressions, but they currently do. In order to avoid breakage, this
patch whitelists them explicitly (which is a no-op at the moment) so that
we can change Blink's behavior without breaking extensions.

Perhaps we can re-evaluate this in v3. :)

BUG=473904
Committed: https://crrev.com/04a6c801d52357e7ad14ecaf8c528a97a3451fd5
Cr-Commit-Position: refs/heads/master@{#334599}

[Mike West, 2015-06-16 13:03:44]

The CQ bit was checked by mkwst@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2015-06-16 13:03:51]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1184353002/1

[Mike West, 2015-06-16 13:04:17]

mkwst@chromium.org changed reviewers:
+ finnur@chromium.org

[Mike West, 2015-06-16 13:04:18]

finnur@, Mind taking a look? (I'm not sure whether or not you're actually still
working on extensions, but you're in a reasonable time zone!)

[Mike West, 2015-06-16 13:04:47]

https://codereview.chromium.org/1184353002/diff/1/extensions/common/manifest_...
File extensions/common/manifest_handlers/csp_info.cc (right):

https://codereview.chromium.org/1184353002/diff/1/extensions/common/manifest_...
extensions/common/manifest_handlers/csp_info.cc:45: ";"
This is all `git cl format`. Sorry. :/

[Finnur, 2015-06-16 13:20:01]

LGTM, with comments.

https://codereview.chromium.org/1184353002/diff/1/extensions/common/manifest_...
File extensions/common/manifest_handlers/csp_info.cc (right):

https://codereview.chromium.org/1184353002/diff/1/extensions/common/manifest_...
extensions/common/manifest_handlers/csp_info.cc:34: "default-src 'self' blob:
filesystem: chrome-extension-resource:;"
This sounds like a reasonable approach if blob: and filesystem: are
(erroneously) implied in 'self' and you want to get rid of that. However, I'd
like to see a bit more bookkeeping for safely getting rid of these new entries,
so perhaps file a bug and CC kalman and maybe someone from security so we can
evaluate and keep track of this.

https://codereview.chromium.org/1184353002/diff/1/extensions/common/manifest_...
extensions/common/manifest_handlers/csp_info.cc:45: ";"
Hmm... Looks less readable and therefore more error-prone this way. :/
Wonder if we should revert this part?

[Mike West, 2015-06-16 13:39:41]

On 2015/06/16 at 13:20:01, finnur wrote:
> LGTM, with comments.
> 
>
https://codereview.chromium.org/1184353002/diff/1/extensions/common/manifest_...
> File extensions/common/manifest_handlers/csp_info.cc (right):
> 
>
https://codereview.chromium.org/1184353002/diff/1/extensions/common/manifest_...
> extensions/common/manifest_handlers/csp_info.cc:34: "default-src 'self' blob:
filesystem: chrome-extension-resource:;"
> This sounds like a reasonable approach if blob: and filesystem: are
(erroneously) implied in 'self' and you want to get rid of that. However, I'd
like to see a bit more bookkeeping for safely getting rid of these new entries,
so perhaps file a bug and CC kalman and maybe someone from security so we can
evaluate and keep track of this.

I'll file a bug.

>
https://codereview.chromium.org/1184353002/diff/1/extensions/common/manifest_...
> extensions/common/manifest_handlers/csp_info.cc:45: ";"
> Hmm... Looks less readable and therefore more error-prone this way. :/
> Wonder if we should revert this part?

I agree. I've reverted it.

[Mike West, 2015-06-16 13:39:44]

The CQ bit was checked by mkwst@chromium.org

[Mike West, 2015-06-16 13:39:45]

The patchset sent to the CQ was uploaded after l-g-t-m from finnur@chromium.org
Link to the patchset: https://codereview.chromium.org/1184353002/#ps40001
(title: "Test.")

[commit-bot: I haz the power, 2015-06-16 13:39:50]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1184353002/40001

[commit-bot: I haz the power, 2015-06-16 14:26:40]

Committed patchset #3 (id:40001)

[commit-bot: I haz the power, 2015-06-16 14:27:25]

Patchset 3 (id:??) landed as
https://crrev.com/04a6c801d52357e7ad14ecaf8c528a97a3451fd5
Cr-Commit-Position: refs/heads/master@{#334599}