Local NTP: Allow iframes from *.google.com

chrome/browser/search/local_ntp_source.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/search/local_ntp_source.h"
 
 #include "base/base64.h"
 #include "base/command_line.h"
 #include "base/feature_list.h"
 #include "base/json/json_string_value_serializer.h"
@@ skipping 413 matching lines @@
          "' "
          "'sha256-yAvSu2Dl9rlQTpQn8P1hcE5GUFQVGbuCMHypwtN6uDg=';";
 }
 
 std::string LocalNtpSource::GetContentSecurityPolicyChildSrc() const {
   DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
 
   if (one_google_bar_service_) {
     // Allow embedding of the most visited iframe, as well as the account
     // switcher and the notifications dropdown from the One Google Bar.
-    // TODO(treib): Figure out a way to also allow staging instances.
-    return base::StringPrintf(
-        "child-src %s https://accounts.google.com/ https://docs.google.com "
-        "https://notifications.google.com;",
-        chrome::kChromeSearchMostVisitedUrl);

[fhorschig, 2017/05/03 10:41:59]

As discussed offline, please point this out in the security review
so that we double-check that this is secure.

+    return base::StringPrintf("child-src %s https://*.google.com/;",
+                              chrome::kChromeSearchMostVisitedUrl);
   }
   // Allow embedding of the most visited iframe.
   return base::StringPrintf("child-src %s;",
                             chrome::kChromeSearchMostVisitedUrl);
 }
 
 void LocalNtpSource::OnOneGoogleBarDataChanged() {
   const base::Optional<OneGoogleBarData>& data =
       one_google_bar_service_->one_google_bar_data();
   if (data.has_value())
@@ skipping 41 matching lines @@
       base::Bind(&LocalNtpSource::SetDefaultSearchProviderIsGoogleOnIOThread,
                  weak_ptr_factory_.GetWeakPtr(), is_google));
 }
 
 void LocalNtpSource::SetDefaultSearchProviderIsGoogleOnIOThread(
     bool is_google) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
 
   default_search_provider_is_google_io_thread_ = is_google;
 }