Enable CSP on more WebUI pages

chrome/browser/ui/webui/system_info_ui.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/system_info_ui.h"
 
 #include <memory>
 #include <utility>
 
 #include "base/bind.h"
@@ skipping 41 matching lines @@
   // content::URLDataSource implementation.
   std::string GetSource() const override;
   void StartDataRequest(
       const std::string& path,
       int render_process_id,
       int render_frame_id,
       const content::URLDataSource::GotDataCallback& callback) override;
   std::string GetMimeType(const std::string&) const override {
     return "text/html";
   }
-  bool ShouldAddContentSecurityPolicy() const override { return false; }
+  std::string GetContentSecurityPolicyScriptSrc() const override {
+    // Add 'unsafe-inline' to script-src.
+    return "script-src 'self' chrome://resources 'unsafe-eval' "
+                      "'unsafe-inline';";
+  }
+
+  std::string GetContentSecurityPolicyObjectSrc() const override {
+    // Add style-src.
+    return "object-src 'none'; style-src 'self' chrome://resources "
+                      "'unsafe-inline';";
+  }
 
  private:
   ~SystemInfoUIHTMLSource() override {}
 
   void SysInfoComplete(std::unique_ptr<SystemLogsResponse> response);
   void RequestComplete();
   void WaitForData();
 
   // Stored data from StartDataRequest()
   std::string path_;
@@ skipping 115 matching lines @@
 
 SystemInfoUI::SystemInfoUI(content::WebUI* web_ui) : WebUIController(web_ui) {
   SystemInfoHandler* handler = new SystemInfoHandler();
   web_ui->AddMessageHandler(handler);
   SystemInfoUIHTMLSource* html_source = new SystemInfoUIHTMLSource();
 
   // Set up the chrome://system/ source.
   Profile* profile = Profile::FromWebUI(web_ui);
   content::URLDataSource::Add(profile, html_source);
 }