Restrict app sandbox's CSP to disallow loading web content in them.

chrome/common/extensions/manifest_tests/extension_manifests_sandboxed_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/macros.h"
 #include "chrome/common/extensions/manifest_tests/chrome_manifest_test.h"
 #include "extensions/common/manifest_constants.h"
 #include "extensions/common/manifest_handlers/csp_info.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ skipping 19 matching lines @@
 
   // Sandboxed pages specified with wildcard, no custom CSP value.
   scoped_refptr<Extension> extension4(
       LoadAndExpectSuccess("sandboxed_pages_valid_4.json"));
 
   // Sandboxed pages specified with filename wildcard, no custom CSP value.
   scoped_refptr<Extension> extension5(
       LoadAndExpectSuccess("sandboxed_pages_valid_5.json"));
 
   const char kSandboxedCSP[] =
-      "sandbox allow-scripts allow-forms allow-popups allow-modals";
+      "sandbox allow-scripts allow-forms allow-popups allow-modals; "
+      "script-src 'self' 'unsafe-inline' 'unsafe-eval'; child-src 'self';";
   const char kDefaultCSP[] =
       "script-src 'self' blob: filesystem: chrome-extension-resource:; "
       "object-src 'self' blob: filesystem:;";
   const char kCustomSandboxedCSP[] =
-      "sandbox; script-src: https://www.google.com";
+      "sandbox; script-src 'self'; child-src 'self';";
 
   EXPECT_EQ(
       kSandboxedCSP,
       CSPInfo::GetResourceContentSecurityPolicy(extension1.get(), "/test"));
   EXPECT_EQ(
       kDefaultCSP,
       CSPInfo::GetResourceContentSecurityPolicy(extension1.get(), "/none"));
   EXPECT_EQ(
       kDefaultCSP,
       CSPInfo::GetResourceContentSecurityPolicy(extension2.get(), "/test"));
@@ skipping 23 matching lines @@
     Testcase("sandboxed_pages_invalid_4.json",
         errors::kInvalidSandboxedPagesCSP),
     Testcase("sandboxed_pages_invalid_5.json",
         errors::kInvalidSandboxedPagesCSP)
   };
   RunTestcases(testcases, arraysize(testcases),
                EXPECT_TYPE_ERROR);
 }
 
 }  // namespace extensions