Restrict app sandbox's CSP to disallow loading web content in them.

chrome/test/data/extensions/api_test/sandboxed_pages_csp/local_frame.js

Index: chrome/test/data/extensions/api_test/sandboxed_pages_csp/local_frame.js
diff --git a/chrome/test/data/extensions/api_test/sandboxed_pages_csp/local_frame.js b/chrome/test/data/extensions/api_test/sandboxed_pages_csp/local_frame.js
new file mode 100644
index 0000000000000000000000000000000000000000..11be2b3d387f5782809077cea4717885e79a1e93
--- /dev/null
+++ b/chrome/test/data/extensions/api_test/sandboxed_pages_csp/local_frame.js
@@ -0,0 +1,17 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/*

[Devlin, 2016/12/22 17:04:32]

nit: dead code?

[lazyboy, 2016/12/22 22:57:06]

Removed.

+window.onload = function() {
+  window.parent.postMessage(
+      JSON.stringify(['loaded', 'local_frame.html']), '*');
+};
+*/
+onmessage = function(e) {
+  var data = JSON.parse(e.data);
+  if (data[0] != 'ping')
+    return;
+  var param = data[1];
+  e.source.postMessage(JSON.stringify(['pong', param]), '*');
+};