CSP: "local schemes" should inherit policy when embedded.

chrome/test/data/extensions/api_test/webrequest/test_types.js

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 function getStyleURL() {
   // This is not a style sheet, but it must still be classified as "stylesheet"
   // because it is loaded as a style sheet.
   return getServerURL('empty.html?as-style');
 }
 
 function getScriptURL() {
   // The file is empty, so JS errors will not be generated upon execution.
-  return getServerURL('empty.html?as-script');
+  //
+  // We load from '127.0.0.1', as that is a whitelistable source of script
+  // from outside the extension's package.
+  return getServerURL('empty.html?as-script', '127.0.0.1');
 }
 
 function getFontURL() {
   // Not a font, but will be loaded as a font.
   return getServerURL('empty.html?as-font');
 }
 
 function getWorkerURL() {
   // This file is empty, so it does not generate JavaScript errors when loaded
   // as a worker script.
@@ skipping 172 matching lines @@
           ip: '127.0.0.1',
           fromCache: false,
           statusLine: 'HTTP/1.1 200 OK',
           statusCode: 200,
         },
       }],
       [['onBeforeRequest', 'onBeforeSendHeaders', 'onSendHeaders',
         'onHeadersReceived', 'onResponseStarted', 'onCompleted']],
       getScriptFilter());
 
-    // This tab is an extension, and the default Content Security Policy forbids
-    // injecting external scripts in the page. So we just load the script in a
-    // frame via a data:-URL (which is not subject to the extension's CSP).
-    //
-    // data-URLs are not visible to the webRequest API, so we don't have to
-    // include the frame in the expectations - this is a nice side effect.
     var frame = document.createElement('iframe');
     frame.src = 'data:text/html,<script src="' + getScriptURL() + '"></script>';
     document.body.appendChild(frame);
   },
 
   function typeFont() {
     expect([
       { label: 'onBeforeRequest',
         event: 'onBeforeRequest',
         details: {
@@ skipping 385 matching lines @@
     var frame = document.createElement('iframe');
     document.body.appendChild(frame);
     frame.contentWindow.onunload = function() {
       console.log('Going to send beacon...');
       var sentBeacon = frame.contentWindow.navigator.sendBeacon(getSlowURL());
       chrome.test.assertTrue(sentBeacon);
     };
     frame.remove();
   },
 ]);