Inline scripts were extracted from Polymer elements.

third_party/polymer/README.chromium

Index: third_party/polymer/README.chromium
diff --git a/third_party/polymer/README.chromium b/third_party/polymer/README.chromium
index 5dd90b18d001b9f1502bf95f553e58c0ca615605..ac7de6a3ecfde08c4a1a51dd43ec0086a26cdb15 100644
--- a/third_party/polymer/README.chromium
+++ b/third_party/polymer/README.chromium
@@ -46,9 +46,14 @@ Local Modifications:
 - All the files, except for web-animations.js, README.md and COPYING, were
 removed from the web-animations-js copy.
 - Removed executable bit from the files in 'components/core-list'.
+- Created a copy 'components-extracted' of the 'components' directory with the
+only difference that all inline JavaScript blocks were extracted from Polymer
+HTML elements to external JS files. This version of the Polymer is used in a web
+UI, where CSP forbids an execution of inline scripts. The extraction was made
+with the help of the Vulcanize tool (https://github.com/Polymer/vulcanize).
 
-To restore a content of the 'components' directory from scratch, run the
-./reproduce.sh script (requires bower).
+To restore a content of the 'components' and 'components-extracted' directories
+from scratch, run the ./reproduce.sh script (requires bower and vulcanize).
 
 Note on Bower:
 The directory can be updated by running "bower update". A new component can be
@@ -59,4 +64,3 @@ Also be sure that you listed all the added packages and **all their
 dependencies** in bower.json, and specified **exact** versions of every package
 explicitly. That is needed because Bower can't handle recursive dependencies
 correctly (see http://stackoverflow.com/q/25899532).
-