Disallow CSP source * matching of data:, blob:, and filesystem: URLs

chrome/common/extensions/docs/templates/articles/app_csp.html

 <h1>Content Security Policy</h1>
 
 
 <p>
 If you're not familiar with Content Security Policy (CSP),
 <a href="http://www.html5rocks.com/en/tutorials/security/content-security-policy/">An Introduction to Content Security Policy</a>
 is a good starting point.
 That document covers the broader web platform view of CSP;
 Chrome App CSP isn't as flexible.
 You should also read the
@@ skipping 33 matching lines @@
                 (except for video and audio resources).
                 You can’t embed external resources in an iframe.</li>
         <li>You can’t use string-to-JavaScript methods like
                 <code>eval()</code> and <code>new Function()</code>.</li>
 </ul>
 
 <p>This is implemented via the following policy value:</p>
 
 <pre>
 default-src 'self';
-connect-src *;
+connect-src * data: blob: filesystem:;
 style-src 'self' data: chrome-extension-resource: 'unsafe-inline';
 img-src 'self' data: chrome-extension-resource:;
 frame-src 'self' data: chrome-extension-resource:;
 font-src 'self' data: chrome-extension-resource:;
-media-src *;
+media-src * data: blob: filesystem:;
 </pre>
 
 <p>
 Your Chrome App can only refer to scripts and objects
 within your app, with the exception of media files
 (apps can refer to video and audio outside the package).
 Chrome extensions will let you relax the default Content Security Policy;
 Chrome Apps won’t.
 </p>
 
@@ skipping 47 matching lines @@
 
 <h3 id="embed_content">Embed web content</h3>
 
 <p>
 Instead of using an iframe,
 you can call out to an external URL using a webview tag
 (see <a href="app_external#webview">Embed external web pages</a>).
 </p>
 
 <p class="backtotop"><a href="#top">Back to top</a></p>