Enable CSP on more WebUI pages

chrome/browser/ui/webui/devtools_ui.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/devtools_ui.h"
 
 #include "base/macros.h"
 #include "base/memory/ref_counted_memory.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
@@ skipping 78 matching lines @@
   std::string GetSource() const override;
 
   void StartDataRequest(const std::string& path,
                         int render_process_id,
                         int render_frame_id,
                         const GotDataCallback& callback) override;
 
  private:
   // content::URLDataSource overrides.
   std::string GetMimeType(const std::string& path) const override;
-  bool ShouldAddContentSecurityPolicy() const override;
+  std::string GetContentSecurityPolicyScriptSrc() const override;
+  std::string GetContentSecurityPolicyObjectSrc() const override;
+  std::string GetContentSecurityPolicyFrameSrc() const override;
+
   bool ShouldDenyXFrameOptions() const override;
   bool ShouldServeMimeTypeAsContentTypeHeader() const override;
 
   // net::URLFetcherDelegate overrides.
   void OnURLFetchComplete(const net::URLFetcher* source) override;
 
   // Serves bundled DevTools frontend from ResourceBundle.
   void StartBundledDataRequest(const std::string& path,
                                int render_process_id,
                                int render_frame_id,
@@ skipping 57 matching lines @@
     return;
   }
 
   callback.Run(NULL);
 }
 
 std::string DevToolsDataSource::GetMimeType(const std::string& path) const {
   return GetMimeTypeForPath(path);
 }
 
-bool DevToolsDataSource::ShouldAddContentSecurityPolicy() const {
-  return false;
+std::string DevToolsDataSource::GetContentSecurityPolicyScriptSrc() const {

[pfeldman, 2016/05/25 14:18:38]

Changes to this file are no longer needed.

[wychen, 2016/05/25 22:49:41]

The rules here is stricter than the ones specified in <meta>.
I guess it should be in another CL then.
Reverted this file as well.

+  return "script-src 'self' 'unsafe-eval' https://chrome-devtools-frontend.appspot.com;";
+}
+
+std::string DevToolsDataSource::GetContentSecurityPolicyObjectSrc() const {
+  // Add style-src.
+  return "object-src 'none'; style-src 'self' 'unsafe-inline';";
+}
+
+std::string DevToolsDataSource::GetContentSecurityPolicyFrameSrc() const {
+  return "frame-src chrome-extension://*;";
 }
 
 bool DevToolsDataSource::ShouldDenyXFrameOptions() const {
   return false;
 }
 
 bool DevToolsDataSource::ShouldServeMimeTypeAsContentTypeHeader() const {
   return true;
 }
 
@@ skipping 75 matching lines @@
       bindings_(web_ui->GetWebContents()) {
   web_ui->SetBindings(0);
   Profile* profile = Profile::FromWebUI(web_ui);
   content::URLDataSource::Add(
       profile,
       new DevToolsDataSource(profile->GetRequestContext()));
 }
 
 DevToolsUI::~DevToolsUI() {
 }