Use default CSP for resource loading in webview (instead of platform app's CSP)

extensions/browser/extension_protocols.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/browser/extension_protocols.h"
 
 #include <algorithm>
 #include <string>
 #include <vector>
 
@@ skipping 393 matching lines @@
     if (directory_path.value().empty()) {
       LOG(WARNING) << "Failed to GetPathForExtension: " << extension_id;
       return NULL;
     }
   }
 
   // Set up content security policy.
   std::string content_security_policy;
   bool send_cors_header = false;
   bool follow_symlinks_anywhere = false;
+
   if (extension) {
     std::string resource_path = request->url().path();
-    content_security_policy =
-        extensions::CSPInfo::GetResourceContentSecurityPolicy(extension,
-                                                              resource_path);
+
+    // Use default CSP for <webview>.
+    if (!ExtensionsBrowserClient::Get()->IsWebViewRequest(request)) {
+      content_security_policy =
+          extensions::CSPInfo::GetResourceContentSecurityPolicy(extension,
+                                                                resource_path);
+    }
+
     if ((extension->manifest_version() >= 2 ||
          extensions::WebAccessibleResourcesInfo::HasWebAccessibleResources(
              extension)) &&
         extensions::WebAccessibleResourcesInfo::IsResourceWebAccessible(
-            extension, resource_path))
+            extension, resource_path)) {
       send_cors_header = true;
+    }
 
     follow_symlinks_anywhere =
         (extension->creation_flags() & Extension::FOLLOW_SYMLINKS_ANYWHERE)
         != 0;
   }
 
   // Create a job for a generated background page.
   std::string path = request->url().path();
   if (path.size() > 1 &&
       path.substr(1) == extensions::kGeneratedBackgroundPageFilename) {
@@ skipping 103 matching lines @@
   return new net::HttpResponseHeaders(raw_headers);
 }
 
 net::URLRequestJobFactory::ProtocolHandler* CreateExtensionProtocolHandler(
     bool is_incognito,
     extensions::InfoMap* extension_info_map) {
   return new ExtensionProtocolHandler(is_incognito, extension_info_map);
 }
 
 }  // namespace extensions