Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(2749)

Unified Diff: chrome/common/extensions/manifest_tests/extension_manifests_sandboxed_unittest.cc

Issue 2563843002: Restrict app sandbox's CSP to disallow loading web content in them. (Closed)
Patch Set: sync Created 4 years ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: chrome/common/extensions/manifest_tests/extension_manifests_sandboxed_unittest.cc
diff --git a/chrome/common/extensions/manifest_tests/extension_manifests_sandboxed_unittest.cc b/chrome/common/extensions/manifest_tests/extension_manifests_sandboxed_unittest.cc
index 1c8e0ce9ef48c1841a2cfb6db2fc088a8afd2677..708dfc09e4d6139e4ecac63dda662bf8ff7ed980 100644
--- a/chrome/common/extensions/manifest_tests/extension_manifests_sandboxed_unittest.cc
+++ b/chrome/common/extensions/manifest_tests/extension_manifests_sandboxed_unittest.cc
@@ -37,12 +37,13 @@ TEST_F(SandboxedPagesManifestTest, SandboxedPages) {
LoadAndExpectSuccess("sandboxed_pages_valid_5.json"));
const char kSandboxedCSP[] =
- "sandbox allow-scripts allow-forms allow-popups allow-modals";
+ "sandbox allow-scripts allow-forms allow-popups allow-modals; "
+ "script-src 'self' 'unsafe-inline' 'unsafe-eval'; child-src 'self';";
const char kDefaultCSP[] =
"script-src 'self' blob: filesystem: chrome-extension-resource:; "
"object-src 'self' blob: filesystem:;";
const char kCustomSandboxedCSP[] =
- "sandbox; script-src: https://www.google.com";
+ "sandbox; script-src 'self'; child-src 'self';";
EXPECT_EQ(
kSandboxedCSP,

Powered by Google App Engine
This is Rietveld 408576698