Explicitly whitelist 'blob:' and 'filesystem:' in extensions' default CSP.

extensions/common/manifest_handlers/csp_info.cc

Index: extensions/common/manifest_handlers/csp_info.cc
diff --git a/extensions/common/manifest_handlers/csp_info.cc b/extensions/common/manifest_handlers/csp_info.cc
index e75699525515fceeb88bf7a81e719c1468e96345..c86f2c183dd8fd5b43c97a44ce8bb505462424b9 100644
--- a/extensions/common/manifest_handlers/csp_info.cc
+++ b/extensions/common/manifest_handlers/csp_info.cc
@@ -24,20 +24,25 @@ using csp_validator::SanitizeContentSecurityPolicy;
 namespace {
 
 const char kDefaultContentSecurityPolicy[] =
-    "script-src 'self' chrome-extension-resource:; object-src 'self';";
+    "script-src 'self' blob: filesystem: chrome-extension-resource:; "
+    "object-src 'self' blob: filesystem:;";
 
 #define PLATFORM_APP_LOCAL_CSP_SOURCES \
-    "'self' data: chrome-extension-resource:"
+  "'self' blob: filesystem: data: chrome-extension-resource:"
 const char kDefaultPlatformAppContentSecurityPolicy[] =
     // Platform apps can only use local resources by default.
-    "default-src 'self' chrome-extension-resource:;"
+    "default-src 'self' blob: filesystem: chrome-extension-resource:;"

[Finnur, 2015/06/16 13:20:01]

This sounds like a reasonable approach if blob: and filesystem: are
(erroneously) implied in 'self' and you want to get rid of that. However, I'd
like to see a bit more bookkeeping for safely getting rid of these new entries,
so perhaps file a bug and CC kalman and maybe someone from security so we can
evaluate and keep track of this.

     // For remote resources, they can fetch them via XMLHttpRequest.
     " connect-src *;"
     // And serve them via data: or same-origin (blob:, filesystem:) URLs
-    " style-src " PLATFORM_APP_LOCAL_CSP_SOURCES " 'unsafe-inline';"
-    " img-src " PLATFORM_APP_LOCAL_CSP_SOURCES ";"
-    " frame-src " PLATFORM_APP_LOCAL_CSP_SOURCES ";"
-    " font-src " PLATFORM_APP_LOCAL_CSP_SOURCES ";"
+    " style-src " PLATFORM_APP_LOCAL_CSP_SOURCES
+    " 'unsafe-inline';"
+    " img-src " PLATFORM_APP_LOCAL_CSP_SOURCES
+    ";"
+    " frame-src " PLATFORM_APP_LOCAL_CSP_SOURCES
+    ";"
+    " font-src " PLATFORM_APP_LOCAL_CSP_SOURCES
+    ";"

[Mike West, 2015/06/16 13:04:47]

This is all `git cl format`. Sorry. :/

[Finnur, 2015/06/16 13:20:01]

Hmm... Looks less readable and therefore more error-prone this way. :/
Wonder if we should revert this part?

     // Media can be loaded from remote resources since:
     // 1. <video> and <audio> have good fallback behavior when offline or under
     //    spotty connectivity.