Enable CSP on more WebUI pages

chrome/browser/ui/webui/interstitials/interstitial_ui.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/interstitials/interstitial_ui.h"
 
 #include "base/macros.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "chrome/browser/browser_process.h"
@@ skipping 28 matching lines @@
 // Implementation of chrome://interstitials demonstration pages. This code is
 // not used in displaying any real interstitials.
 class InterstitialHTMLSource : public content::URLDataSource {
  public:
   explicit InterstitialHTMLSource(content::WebContents* web_contents);
   ~InterstitialHTMLSource() override;
 
   // content::URLDataSource:
   std::string GetMimeType(const std::string& mime_type) const override;
   std::string GetSource() const override;
-  bool ShouldAddContentSecurityPolicy() const override;
+  std::string GetContentSecurityPolicyScriptSrc() const override;
+  std::string GetContentSecurityPolicyObjectSrc() const override;
   void StartDataRequest(
       const std::string& path,
       int render_process_id,
       int render_frame_id,
       const content::URLDataSource::GotDataCallback& callback) override;
 
  private:
   content::WebContents* web_contents_;
   DISALLOW_COPY_AND_ASSIGN(InterstitialHTMLSource);
 };
@@ skipping 241 matching lines @@
 
 std::string InterstitialHTMLSource::GetMimeType(
     const std::string& mime_type) const {
   return "text/html";
 }
 
 std::string InterstitialHTMLSource::GetSource() const {
   return chrome::kChromeUIInterstitialHost;
 }
 
-bool InterstitialHTMLSource::ShouldAddContentSecurityPolicy()
-    const {
-  return false;
+std::string InterstitialHTMLSource::GetContentSecurityPolicyScriptSrc() const {
+  // Add 'unsafe-inline' to script-src.
+  return "script-src chrome://resources 'self' 'unsafe-eval' 'unsafe-inline';";
+}
+
+std::string InterstitialHTMLSource::GetContentSecurityPolicyObjectSrc() const {
+  // Add style-src and img-src.
+  return "object-src 'none';"
+      "style-src 'self' 'unsafe-inline';"

[Tom Sepez, 2016/05/25 23:07:03]

Here we're still mixing object, style, and img.

[wychen, 2016/05/26 17:54:23]

Oops. Fixed.

+      "img-src data:;";
 }
 
 void InterstitialHTMLSource::StartDataRequest(
     const std::string& path,
     int render_process_id,
     int render_frame_id,
     const content::URLDataSource::GotDataCallback& callback) {
   std::unique_ptr<content::InterstitialPageDelegate> interstitial_delegate;
   if (base::StartsWith(path, "ssl", base::CompareCase::SENSITIVE)) {
     interstitial_delegate.reset(CreateSSLBlockingPage(web_contents_));
@@ skipping 15 matching lines @@
     html = interstitial_delegate.get()->GetHTMLContents();
   } else {
     html = ResourceBundle::GetSharedInstance()
                           .GetRawDataResource(IDR_SECURITY_INTERSTITIAL_UI_HTML)
                           .as_string();
   }
   scoped_refptr<base::RefCountedString> html_bytes = new base::RefCountedString;
   html_bytes->data().assign(html.begin(), html.end());
   callback.Run(html_bytes.get());
 }