Enable CSP on more WebUI pages

chrome/browser/ui/webui/app_launcher_page_ui.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/app_launcher_page_ui.h"
 
 #include <string>
 
 #include "base/memory/ref_counted_memory.h"
 #include "base/metrics/histogram.h"
@@ skipping 113 matching lines @@
 
 std::string AppLauncherPageUI::HTMLSource::GetMimeType(
     const std::string& resource) const {
   return "text/html";
 }
 
 bool AppLauncherPageUI::HTMLSource::ShouldReplaceExistingSource() const {
   return false;
 }
 
-bool AppLauncherPageUI::HTMLSource::ShouldAddContentSecurityPolicy() const {
-  return false;
+std::string AppLauncherPageUI::HTMLSource::GetContentSecurityPolicyScriptSrc()
+    const {
+  // 'unsafe-inline' is added to script-src.
+  return "script-src chrome://resources 'self' 'unsafe-eval' 'unsafe-inline';";
+}
+
+std::string AppLauncherPageUI::HTMLSource::GetContentSecurityPolicyStyleSrc()
+    const {
+  return "style-src 'self' chrome://resources chrome://theme 'unsafe-inline';";
+}
+
+std::string AppLauncherPageUI::HTMLSource::GetContentSecurityPolicyImgSrc()
+    const {
+  return "img-src chrome://extension-icon chrome://theme chrome://resources "
+      "data:;";
 }
 
 AppLauncherPageUI::HTMLSource::~HTMLSource() {}