Remove chrome-extension-resource:// scheme

extensions/common/csp_validator.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/common/csp_validator.h"
 
 #include <stddef.h>
 
 #include <vector>
 
@@ skipping 13 matching lines @@
 namespace csp_validator {
 
 namespace {
 
 const char kDefaultSrc[] = "default-src";
 const char kScriptSrc[] = "script-src";
 const char kObjectSrc[] = "object-src";
 const char kPluginTypes[] = "plugin-types";
 
 const char kObjectSrcDefaultDirective[] = "object-src 'self';";
-const char kScriptSrcDefaultDirective[] =
-    "script-src 'self' chrome-extension-resource:;";
+const char kScriptSrcDefaultDirective[] = "script-src 'self';";
 
 const char kSandboxDirectiveName[] = "sandbox";
 const char kAllowSameOriginToken[] = "allow-same-origin";
 const char kAllowTopNavigation[] = "allow-top-navigation";
 
 // This is the list of plugin types which are fully sandboxed and are safe to
 // load up in an extension, regardless of the URL they are navigated to.
 const char* const kSandboxedPluginTypes[] = {
   "application/pdf",
   "application/x-google-chrome-pdf",
@@ skipping 123 matching lines @@
         base::StartsWith(source_lower, "http://127.0.0.1:",
                          base::CompareCase::SENSITIVE) ||
         base::StartsWith(source_lower, "http://localhost:",
                          base::CompareCase::SENSITIVE) ||
         isNonWildcardTLD(source_lower, "https://", true) ||
         isNonWildcardTLD(source_lower, "chrome://", false) ||
         isNonWildcardTLD(source_lower,
                          std::string(extensions::kExtensionScheme) +
                              url::kStandardSchemeSeparator,
                          false) ||
-        IsHashSource(source_literal) ||
-        base::StartsWith(source_lower, "chrome-extension-resource:",
-                         base::CompareCase::SENSITIVE)) {
+        IsHashSource(source_literal)) {
       is_secure_csp_token = true;
     } else if ((options & OPTIONS_ALLOW_UNSAFE_EVAL) &&
                source_lower == "'unsafe-eval'") {
       is_secure_csp_token = true;
+    } else if (base::StartsWith(source_lower, "chrome-extension-resource:",
+                                base::CompareCase::SENSITIVE)) {
+      // The "chrome-extension-resource" scheme has been removed from the
+      // codebase, but it may still appear in existing CSPs. We continue to
+      // allow it here for compatibility. Requests on this scheme will not
+      // return any kind of network response.
+      is_secure_csp_token = true;
     }
 
     if (is_secure_csp_token) {
       sane_csp_parts->push_back(source_literal);
     } else if (warnings) {
       warnings->push_back(CSPInstallWarning(ErrorUtils::FormatErrorMessage(
           manifest_errors::kInvalidCSPInsecureValue, source_literal,
           directive_name)));
     }
   }
@@ skipping 171 matching lines @@
       }
     }
   }
 
   return seen_sandbox;
 }
 
 }  // namespace csp_validator
 
 }  // namespace extensions