Explicitly whitelist 'blob:' and 'filesystem:' in extensions' default CSP.

chrome/common/extensions/manifest_tests/extension_manifests_sandboxed_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/extensions/manifest_tests/chrome_manifest_test.h"
 #include "extensions/common/manifest_constants.h"
 #include "extensions/common/manifest_handlers/csp_info.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace extensions {
@@ skipping 19 matching lines @@
   // Sandboxed pages specified with wildcard, no custom CSP value.
   scoped_refptr<Extension> extension4(
       LoadAndExpectSuccess("sandboxed_pages_valid_4.json"));
 
   // Sandboxed pages specified with filename wildcard, no custom CSP value.
   scoped_refptr<Extension> extension5(
       LoadAndExpectSuccess("sandboxed_pages_valid_5.json"));
 
   const char kSandboxedCSP[] = "sandbox allow-scripts allow-forms allow-popups";
   const char kDefaultCSP[] =
-      "script-src 'self' chrome-extension-resource:; object-src 'self';";
+      "script-src 'self' blob: filesystem: chrome-extension-resource:; "
+      "object-src 'self' blob: filesystem:;";
   const char kCustomSandboxedCSP[] =
       "sandbox; script-src: https://www.google.com";
 
   EXPECT_EQ(
       kSandboxedCSP,
       CSPInfo::GetResourceContentSecurityPolicy(extension1.get(), "/test"));
   EXPECT_EQ(
       kDefaultCSP,
       CSPInfo::GetResourceContentSecurityPolicy(extension1.get(), "/none"));
   EXPECT_EQ(
@@ skipping 25 matching lines @@
     Testcase("sandboxed_pages_invalid_4.json",
         errors::kInvalidSandboxedPagesCSP),
     Testcase("sandboxed_pages_invalid_5.json",
         errors::kInvalidSandboxedPagesCSP)
   };
   RunTestcases(testcases, arraysize(testcases),
                EXPECT_TYPE_ERROR);
 }
 
 }  // namespace extensions