[dom_distiller] Fix viewer to use Open Sans webfont.

[dom_distiller] Fix viewer to use Open Sans webfont.

Previously we were specifying to use Open Sans but the font isn't loaded on Android.
Use the webfont hosted on Google and update CSP to allow it.

Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=288497

[nyquist, 2014-08-07 04:50:46]

https://codereview.chromium.org/443343002/diff/1/components/dom_distiller/con...
File components/dom_distiller/content/dom_distiller_viewer_source.cc (right):

https://codereview.chromium.org/443343002/diff/1/components/dom_distiller/con...
components/dom_distiller/content/dom_distiller_viewer_source.cc:332: return
"object-src 'none'; style-src 'self' http://fonts.googleapis.com;";
drive-by: I know the documentation seem to specify http://, but it seems like
https works as well. WDYT about using that instead?

[Yaron, 2014-08-07 05:03:36]

https://codereview.chromium.org/443343002/diff/1/components/dom_distiller/con...
File components/dom_distiller/content/dom_distiller_viewer_source.cc (right):

https://codereview.chromium.org/443343002/diff/1/components/dom_distiller/con...
components/dom_distiller/content/dom_distiller_viewer_source.cc:332: return
"object-src 'none'; style-src 'self' http://fonts.googleapis.com;";
On 2014/08/07 04:50:46, nyquist wrote:
> drive-by: I know the documentation seem to specify http://, but it seems like
> https works as well. WDYT about using that instead?

I thought about it, but I honestly don't know how much there is to gain. I
assume the serving on https is to avoid have insecure warning if your page is
https but otherwise is unnecessary.

[nyquist, 2014-08-08 18:23:01]

was there a bug for this?

anyway, lgtm

[Yaron, 2014-08-08 18:42:30]

The CQ bit was checked by yfriedman@chromium.org

[commit-bot: I haz the power, 2014-08-08 18:44:47]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/yfriedman@chromium.org/443343002/1

[cjhopman, 2014-08-08 18:48:20]

https://codereview.chromium.org/443343002/diff/1/components/dom_distiller/con...
File components/dom_distiller/content/dom_distiller_viewer_source.cc (right):

https://codereview.chromium.org/443343002/diff/1/components/dom_distiller/con...
components/dom_distiller/content/dom_distiller_viewer_source.cc:332: return
"object-src 'none'; style-src 'self' http://fonts.googleapis.com;";
On 2014/08/07 05:03:36, Yaron wrote:
> On 2014/08/07 04:50:46, nyquist wrote:
> > drive-by: I know the documentation seem to specify http://, but it seems
like
> > https works as well. WDYT about using that instead?
> 
> I thought about it, but I honestly don't know how much there is to gain. I
> assume the serving on https is to avoid have insecure warning if your page is
> https but otherwise is unnecessary. 

Using http allows a mitm to inject style into the page. I'd say use https for
everything unless it's not possible.

[Yaron, 2014-08-08 19:02:09]

The CQ bit was unchecked by yfriedman@chromium.org

[Yaron, 2014-08-08 19:02:17]

On 2014/08/08 18:48:20, cjhopman wrote:
>
https://codereview.chromium.org/443343002/diff/1/components/dom_distiller/con...
> File components/dom_distiller/content/dom_distiller_viewer_source.cc (right):
> 
>
https://codereview.chromium.org/443343002/diff/1/components/dom_distiller/con...
> components/dom_distiller/content/dom_distiller_viewer_source.cc:332: return
> "object-src 'none'; style-src 'self' http://fonts.googleapis.com;%22;
> On 2014/08/07 05:03:36, Yaron wrote:
> > On 2014/08/07 04:50:46, nyquist wrote:
> > > drive-by: I know the documentation seem to specify http://, but it seems
> like
> > > https works as well. WDYT about using that instead?
> > 
> > I thought about it, but I honestly don't know how much there is to gain. I
> > assume the serving on https is to avoid have insecure warning if your page
is
> > https but otherwise is unnecessary. 
> 
> Using http allows a mitm to inject style into the page. I'd say use https for
> everything unless it's not possible.

mitm injecting style? I mean sure, since you both raised it.

[Yaron, 2014-08-08 20:00:24]

The CQ bit was checked by yfriedman@chromium.org

[commit-bot: I haz the power, 2014-08-08 20:02:15]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/yfriedman@chromium.org/443343002/60001

[commit-bot: I haz the power, 2014-08-09 00:40:04]

FYI, CQ is re-trying this CL (attempt #1).
The failing builders are:
  android_dbg_triggered_tests on tryserver.chromium.linux
(http://build.chromium.org/p/tryserver.chromium.linux/builders/android_dbg_tri...)
  win_chromium_rel on tryserver.chromium.win
(http://build.chromium.org/p/tryserver.chromium.win/builders/win_chromium_rel/...)

[commit-bot: I haz the power, 2014-08-09 03:02:09]

Change committed as 288497