Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(8932)

Unified Diff: chrome/browser/ui/webui/system_info_ui.cc

Issue 2003963004: Enable CSP on more WebUI pages (Closed) Base URL: https://chromium.googlesource.com/a/chromium/src.git@master
Patch Set: fix oopsies Created 4 years, 7 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: chrome/browser/ui/webui/system_info_ui.cc
diff --git a/chrome/browser/ui/webui/system_info_ui.cc b/chrome/browser/ui/webui/system_info_ui.cc
index 7aa85064f3ed80f6e9d09f6b65feaa2129992668..9bb9b96995b35d2c204462d50a49a659bc0e0851 100644
--- a/chrome/browser/ui/webui/system_info_ui.cc
+++ b/chrome/browser/ui/webui/system_info_ui.cc
@@ -59,7 +59,15 @@ class SystemInfoUIHTMLSource : public content::URLDataSource{
std::string GetMimeType(const std::string&) const override {
return "text/html";
}
- bool ShouldAddContentSecurityPolicy() const override { return false; }
+ std::string GetContentSecurityPolicyScriptSrc() const override {
+ // Add 'unsafe-inline' to script-src.
+ return "script-src 'self' chrome://resources 'unsafe-eval' "
+ "'unsafe-inline';";
+ }
+
+ std::string GetContentSecurityPolicyStyleSrc() const override {
+ return "style-src 'self' chrome://resources 'unsafe-inline';";
+ }
private:
~SystemInfoUIHTMLSource() override {}

Powered by Google App Engine
This is Rietveld 408576698