Create a proprietary scheme for loading web-accessible resources.

content/renderer/render_thread_impl.cc

Index: content/renderer/render_thread_impl.cc
diff --git a/content/renderer/render_thread_impl.cc b/content/renderer/render_thread_impl.cc
index a03732c1295e8d36cfb91a3965cf49941dc08638..4b83dffa4899cdac97c1abf07c64a9699489a9cf 100644
--- a/content/renderer/render_thread_impl.cc
+++ b/content/renderer/render_thread_impl.cc
@@ -974,6 +974,14 @@ void RenderThreadImpl::RegisterSchemes() {
   WebString swappedout_scheme(base::ASCIIToUTF16(kSwappedOutScheme));
   WebSecurityPolicy::registerURLSchemeAsDisplayIsolated(swappedout_scheme);
   WebSecurityPolicy::registerURLSchemeAsEmptyDocument(swappedout_scheme);
+
+  // This scheme serves resources that may be injected into the
+  // web page (e.g. by Blink). This isn't mixed content, and
+  // content security policy doesn't apply.
+  WebString resource_scheme(base::ASCIIToUTF16(kResourceScheme));
+  WebSecurityPolicy::registerURLSchemeAsSecure(resource_scheme);
+  WebSecurityPolicy::registerURLSchemeAsBypassingContentSecurityPolicy(

[Tom Sepez, 2014/11/17 18:09:11]

Do we need to bypass CSP?  For a CSP-enabled web page that uses this feature,
I'd expect the page to explicitly list 'chrome-resources:' as part of their
policy.  For CSP-enabled pages that don't use this feature, it would be a shame
to allow them to be vulnerable by default to flaws in some chrome-resource://
script.

[jbroman, 2014/11/17 18:35:16]

The goal is to be able to use this scheme to host resources for features the
author may not even be aware of, like the close button graphics in a plugin
placeholder, or some other style resource that's internal to a feature that
the author need not be aware of. I wouldn't expect an author to ever write
"chrome-resource://" in their own document (and would loosely describe the
contract for that scheme as "this is for Chrome's use and valid URLs may
change at any time without warning").

I don't think authors should need to be aware of implementation details of
each user agent to avoid strange breakage of UA features that are supposed
to be, from their perspective, entirely encapsulated.

I don't intend to put scripts there, just stylesheets (for use in UA shadow
roots) and images. I can make the warning comment at the registration sites
more specific if that's helpful. I agree that some caution would have to be
used before a resource is added to a CSP-bypassing scheme.

I see this as analogous to chrome-extension:// web-accessible resources, which
the author doesn't know about.

Is that clear and reasonable, or have I missed your point?

+      resource_scheme);
 }
 
 void RenderThreadImpl::NotifyTimezoneChange() {