Whitelist themes in CSP of chrome://newtab

chrome/browser/ui/webui/ntp/new_tab_ui.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/ntp/new_tab_ui.h"
 
 #include <memory>
 
 #include "base/i18n/rtl.h"
 #include "base/memory/ref_counted_memory.h"
@@ skipping 224 matching lines @@
       "*.google.com *.gstatic.com;";
 }
 
 std::string NewTabUI::NewTabHTMLSource::GetContentSecurityPolicyStyleSrc()
     const {
   return "style-src 'self' chrome://resources 'unsafe-inline' chrome://theme;";
 }
 
 std::string NewTabUI::NewTabHTMLSource::GetContentSecurityPolicyImgSrc()
     const {
-  return "img-src chrome-search://thumb chrome-search://thumb2 data:;";
+  return "img-src chrome-search://thumb chrome-search://thumb2 "
+      "chrome-search://theme chrome://theme data:;";
 }
 
 std::string NewTabUI::NewTabHTMLSource::GetContentSecurityPolicyChildSrc()
     const {
   return "child-src chrome-search://most-visited;";
 }
 
 void NewTabUI::NewTabHTMLSource::AddResource(const char* resource,
                                              const char* mime_type,
                                              int resource_id) {
   DCHECK(resource);
   DCHECK(mime_type);
   resource_map_[std::string(resource)] =
       std::make_pair(std::string(mime_type), resource_id);
 }
 
 NewTabUI::NewTabHTMLSource::~NewTabHTMLSource() {}