Remove chrome-extension-resource:// scheme

extensions/common/csp_validator_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stddef.h>
 
 #include "extensions/common/csp_validator.h"
 #include "extensions/common/error_utils.h"
 #include "extensions/common/install_warning.h"
 #include "extensions/common/manifest_constants.h"
@@ skipping 106 matching lines @@
       "default-src 'self'; script-src http://www.google.com"));
   EXPECT_FALSE(ContentSecurityPolicyIsLegal(
       "default-src 'self';\nscript-src http://www.google.com"));
   EXPECT_FALSE(ContentSecurityPolicyIsLegal(
       "default-src 'self';\rscript-src http://www.google.com"));
   EXPECT_FALSE(ContentSecurityPolicyIsLegal(
       "default-src 'self';,script-src http://www.google.com"));
 }
 
 TEST(ExtensionCSPValidator, IsSecure) {
+  EXPECT_TRUE(CheckSanitizeCSP(std::string(), OPTIONS_ALLOW_UNSAFE_EVAL,
+                               "script-src 'self'; object-src 'self';",
+                               MissingSecureSrcWarning("script-src"),
+                               MissingSecureSrcWarning("object-src")));
   EXPECT_TRUE(CheckSanitizeCSP(
-      std::string(), OPTIONS_ALLOW_UNSAFE_EVAL,
-      "script-src 'self' chrome-extension-resource:; object-src 'self';",
+      "img-src https://google.com", OPTIONS_ALLOW_UNSAFE_EVAL,
+      "img-src https://google.com; script-src 'self'; object-src 'self';",
       MissingSecureSrcWarning("script-src"),
       MissingSecureSrcWarning("object-src")));
   EXPECT_TRUE(CheckSanitizeCSP(
-      "img-src https://google.com", OPTIONS_ALLOW_UNSAFE_EVAL,
-      "img-src https://google.com; script-src 'self'"
-      " chrome-extension-resource:; object-src 'self';",
-      MissingSecureSrcWarning("script-src"),
-      MissingSecureSrcWarning("object-src")));
-  EXPECT_TRUE(CheckSanitizeCSP(
       "script-src a b", OPTIONS_ALLOW_UNSAFE_EVAL,
       "script-src; object-src 'self';",
       InsecureValueWarning("script-src", "a"),
       InsecureValueWarning("script-src", "b"),
       MissingSecureSrcWarning("object-src")));
 
   EXPECT_TRUE(CheckSanitizeCSP(
       "default-src *", OPTIONS_ALLOW_UNSAFE_EVAL,
       "default-src;",
       InsecureValueWarning("default-src", "*")));
@@ skipping 58 matching lines @@
       "default-src 'self' http://google.com", OPTIONS_ALLOW_UNSAFE_EVAL,
       "default-src 'self';",
       InsecureValueWarning("default-src", "http://google.com")));
   EXPECT_TRUE(CheckSanitizeCSP(
       "default-src 'self' https://google.com;", OPTIONS_ALLOW_UNSAFE_EVAL));
   EXPECT_TRUE(CheckSanitizeCSP(
       "default-src 'self' chrome://resources;", OPTIONS_ALLOW_UNSAFE_EVAL));
   EXPECT_TRUE(CheckSanitizeCSP(
       "default-src 'self' chrome-extension://aabbcc;",
       OPTIONS_ALLOW_UNSAFE_EVAL));
-  EXPECT_TRUE(CheckSanitizeCSP(
-      "default-src 'self' chrome-extension-resource://aabbcc;",
-      OPTIONS_ALLOW_UNSAFE_EVAL));
-  EXPECT_TRUE(CheckSanitizeCSP(
-      "default-src 'self' https:", OPTIONS_ALLOW_UNSAFE_EVAL,
-      "default-src 'self';",
-      InsecureValueWarning("default-src", "https:")));
+  // chrome-extension-resource (which doesn't exist anymore) is quietly ignored.
+  EXPECT_TRUE(
+      CheckSanitizeCSP("default-src 'self' chrome-extension-resource://aabbcc;",
+                       OPTIONS_ALLOW_UNSAFE_EVAL, "default-src 'self';"));
+  EXPECT_TRUE(
+      CheckSanitizeCSP("default-src 'self' chrome-extension-resource://aabbcc "
+                       "chrome-extension://aabbcc;",
+                       OPTIONS_ALLOW_UNSAFE_EVAL,
+                       "default-src 'self' chrome-extension://aabbcc;"));
+  EXPECT_TRUE(CheckSanitizeCSP("default-src 'self' https:",
+                               OPTIONS_ALLOW_UNSAFE_EVAL, "default-src 'self';",
+                               InsecureValueWarning("default-src", "https:")));
   EXPECT_TRUE(CheckSanitizeCSP(
       "default-src 'self' http:", OPTIONS_ALLOW_UNSAFE_EVAL,
       "default-src 'self';",
       InsecureValueWarning("default-src", "http:")));
   EXPECT_TRUE(CheckSanitizeCSP(
       "default-src 'self' google.com", OPTIONS_ALLOW_UNSAFE_EVAL,
       "default-src 'self';",
       InsecureValueWarning("default-src", "google.com")));
 
   EXPECT_TRUE(CheckSanitizeCSP(
@@ skipping 213 matching lines @@
       "sandbox allow-top-navigation", Manifest::TYPE_EXTENSION));
   EXPECT_FALSE(ContentSecurityPolicyIsSandboxed(
       "sandbox allow-top-navigation", Manifest::TYPE_PLATFORM_APP));
 
   // Popups are OK.
   EXPECT_TRUE(ContentSecurityPolicyIsSandboxed(
       "sandbox allow-popups", Manifest::TYPE_EXTENSION));
   EXPECT_TRUE(ContentSecurityPolicyIsSandboxed(
       "sandbox allow-popups", Manifest::TYPE_PLATFORM_APP));
 }