Create a proprietary scheme for loading web-accessible resources.

content/renderer/render_thread_impl.cc

Index: content/renderer/render_thread_impl.cc
diff --git a/content/renderer/render_thread_impl.cc b/content/renderer/render_thread_impl.cc
index a03732c1295e8d36cfb91a3965cf49941dc08638..4b83dffa4899cdac97c1abf07c64a9699489a9cf 100644
--- a/content/renderer/render_thread_impl.cc
+++ b/content/renderer/render_thread_impl.cc
@@ -974,6 +974,14 @@ void RenderThreadImpl::RegisterSchemes() {
   WebString swappedout_scheme(base::ASCIIToUTF16(kSwappedOutScheme));
   WebSecurityPolicy::registerURLSchemeAsDisplayIsolated(swappedout_scheme);
   WebSecurityPolicy::registerURLSchemeAsEmptyDocument(swappedout_scheme);
+
+  // This scheme serves resources that may be injected into the
+  // web page (e.g. by Blink). This isn't mixed content, and
+  // content security policy doesn't apply.
+  WebString resource_scheme(base::ASCIIToUTF16(kResourceScheme));
+  WebSecurityPolicy::registerURLSchemeAsSecure(resource_scheme);
+  WebSecurityPolicy::registerURLSchemeAsBypassingContentSecurityPolicy(
+      resource_scheme);
 }
 
 void RenderThreadImpl::NotifyTimezoneChange() {