Fix csp flags send to browsers.

tools/testing/dart/http_server.dart

Index: tools/testing/dart/http_server.dart
===================================================================
--- tools/testing/dart/http_server.dart	(revision 21862)
+++ tools/testing/dart/http_server.dart	(working copy)
@@ -55,6 +55,9 @@
       defaultsTo: '127.0.0.1');
   parser.addFlag('csp', help: 'Use Content Security Policy restrictions.',
       defaultsTo: false);
+  parser.addOption('runtime', help: 'The runtime we are using (for csp flags).',
+      defaultsTo: 'none');
+
   var args = parser.parse(new Options().arguments);
   if (args['help']) {
     print(parser.getUsage());
@@ -68,7 +71,8 @@
         .canonicalize()
         .toNativePath();
     var servers = new TestingServers(new Path(args['build-directory']),
-                                     args['csp']);
+                                     args['csp'],
+                                     args['runtime']);
     var port = int.parse(args['port']);
     var crossOriginPort = int.parse(args['crossOriginPort']);
     servers.startServers(args['network'],
@@ -88,8 +92,11 @@
   List _serverList = [];
   Path _buildDirectory = null;
   final bool useContentSecurityPolicy;
+  final String runtime;
 
-  TestingServers(Path buildDirectory, this.useContentSecurityPolicy) {
+  TestingServers(Path buildDirectory,
+                 this.useContentSecurityPolicy,
+                 [String this.runtime = 'none']) {
     _buildDirectory = TestUtils.absolutePath(buildDirectory);
   }
 
@@ -118,9 +125,8 @@
     var script = dartDir.join(new Path("tools/testing/dart/http_server.dart"));
     var buildDirectory = _buildDirectory.toNativePath();
     var csp = useContentSecurityPolicy ? '--csp ' : '';
-
     return '$dart $script -p $port -c $crossOriginPort $csp'
-           '--build-directory=$buildDirectory';
+           '--build-directory=$buildDirectory --runtime=$runtime';
   }
 
   void stopServers() {
@@ -321,10 +327,13 @@
       // whereas Firefox and IE10 use X-Content-Security-Policy. Safari
       // still uses the WebKit- prefixed version.
       for (var header in ["Content-Security-Policy",
-                          "X-Content-Security-Policy",
-                          "X-WebKit-CSP"]) {
+                          "X-Content-Security-Policy"]) {
         response.headers.set(header, "script-src 'self'; object-src 'self'");
       }
+      if (runtime == "safari") {

[kustermann, 2013/04/30 11:36:51]

Once we're doing mobile stuff as well, we have more than one 'safari' based
browser. Maybe we should make a list or so?

+        response.headers.set("X-WebKit-CSP",
+                             "script-src 'self'; object-src 'self'");

[kustermann, 2013/04/30 11:36:51]

You could extract the "script-sr....." into a variable so we don't have it
twice.

+      }
     }
     if (path.filename.endsWith('.html')) {
       response.headers.set('Content-Type', 'text/html');