Enable CSP on more WebUI pages

chrome/browser/ui/webui/app_launcher_page_ui.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/app_launcher_page_ui.h"
 
 #include <string>
 
 #include "base/memory/ref_counted_memory.h"
 #include "base/metrics/histogram.h"
@@ skipping 113 matching lines @@
 
 std::string AppLauncherPageUI::HTMLSource::GetMimeType(
     const std::string& resource) const {
   return "text/html";
 }
 
 bool AppLauncherPageUI::HTMLSource::ShouldReplaceExistingSource() const {
   return false;
 }
 
-bool AppLauncherPageUI::HTMLSource::ShouldAddContentSecurityPolicy() const {
-  return false;
+std::string AppLauncherPageUI::HTMLSource::GetContentSecurityPolicyScriptSrc()
+    const {
+  // Add 'unsafe-inline' to script-src.

[Tom Sepez, 2016/05/25 19:20:56]

Note that unsafe-inline is not really any better than no CSP, but ok.

[wychen, 2016/05/25 22:49:41]

Acknowledged.

+  return "script-src chrome://resources 'self' 'unsafe-eval' 'unsafe-inline';";
+}
+
+std::string AppLauncherPageUI::HTMLSource::GetContentSecurityPolicyObjectSrc()
+    const {
+  // Add style-src and img-src.
+  return "object-src 'none';"
+      "style-src 'self' chrome://resources chrome://theme 'unsafe-inline';"

[Tom Sepez, 2016/05/25 19:20:56]

Seems wrong to mash these together.  Can we introduce separate overridable
methods for each while we're making this change?

[wychen, 2016/05/25 22:49:41]

Done.

+      "img-src chrome://extension-icon chrome://theme chrome://resources "
+              "data:;";
 }
 
 AppLauncherPageUI::HTMLSource::~HTMLSource() {}