Enable CSP on more WebUI pages

chrome/browser/ui/webui/ntp/new_tab_ui.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/ntp/new_tab_ui.h"
 
 #include <memory>
 
 #include "base/i18n/rtl.h"
 #include "base/memory/ref_counted_memory.h"
@@ skipping 210 matching lines @@
       resource_map_.find(resource);
   if (it != resource_map_.end())
     return it->second.first;
   return "text/html";
 }
 
 bool NewTabUI::NewTabHTMLSource::ShouldReplaceExistingSource() const {
   return false;
 }
 
-bool NewTabUI::NewTabHTMLSource::ShouldAddContentSecurityPolicy() const {
-  return false;
+std::string NewTabUI::NewTabHTMLSource::GetContentSecurityPolicyScriptSrc()
+    const {
+  // Add 'unsafe-inline' and google resources to script-src.
+  return "script-src chrome://resources 'self' 'unsafe-eval' 'unsafe-inline' "
+                    "*.google.com *.gstatic.com;";

[Dan Beam, 2016/05/31 21:46:09]

why is this wrapped here?

[wychen, 2016/05/31 23:04:34]

Otherwise it couldn't fit in 80 chars. The whole string is still one line.

[Dan Beam, 2016/05/31 23:13:14]

i meant: the indent should be 4 \s for a continuation, right?

[wychen, 2016/06/01 00:19:19]

Oh. I see what you meant. I aligned the 2nd line with the first source.
Fixed.

+}
+
+std::string NewTabUI::NewTabHTMLSource::GetContentSecurityPolicyStyleSrc()
+    const {
+  return "style-src 'self' chrome://resources 'unsafe-inline' chrome://theme;";
+}
+
+std::string NewTabUI::NewTabHTMLSource::GetContentSecurityPolicyImgSrc()
+    const {
+  return "img-src chrome-search://thumb chrome-search://thumb2 data:;";
+}
+
+std::string NewTabUI::NewTabHTMLSource::GetContentSecurityPolicyFrameSrc()
+    const {
+  return "frame-src chrome-search://most-visited;";
 }
 
 void NewTabUI::NewTabHTMLSource::AddResource(const char* resource,
                                              const char* mime_type,
                                              int resource_id) {
   DCHECK(resource);
   DCHECK(mime_type);
   resource_map_[std::string(resource)] =
       std::make_pair(std::string(mime_type), resource_id);
 }
 
 NewTabUI::NewTabHTMLSource::~NewTabHTMLSource() {}