Allow *.googleapis.com to be used in CSP

Allow *.googleapis.com to be used in CSP

BUG=409952, 410045
(comment 8 and onwards)
R=kalman@chromium.org

Committed: https://crrev.com/00c9de31dd87447dad58e6113ad47bbf3e3547ae
Cr-Commit-Position: refs/heads/master@{#301280}

[not at google - send to devlin, 2014-10-24 22:16:52]

https://codereview.chromium.org/673183003/diff/1/extensions/common/csp_valida...
File extensions/common/csp_validator.cc (right):

https://codereview.chromium.org/673183003/diff/1/extensions/common/csp_valida...
extensions/common/csp_validator.cc:92: // content directly under the public
suffix without a subdomain.
Reference that bug here. Also some examples in the comment would be good.

https://codereview.chromium.org/673183003/diff/1/extensions/common/csp_valida...
File extensions/common/csp_validator_unittest.cc (right):

https://codereview.chromium.org/673183003/diff/1/extensions/common/csp_valida...
extensions/common/csp_validator_unittest.cc:171: "default-src 'self'
https://s3.amazonaws.com", Manifest::TYPE_EXTENSION));
Isn't s3.amazonaws.com considered secure either way (before and after your
change)? Can you test something that is affected by the change and/or would have
been a regression?

[robwu, 2014-10-24 22:34:09]

https://codereview.chromium.org/673183003/diff/1/extensions/common/csp_valida...
File extensions/common/csp_validator.cc (right):

https://codereview.chromium.org/673183003/diff/1/extensions/common/csp_valida...
extensions/common/csp_validator.cc:92: // content directly under the public
suffix without a subdomain.
On 2014/10/24 22:16:51, kalman wrote:
> Reference that bug here. Also some examples in the comment would be good.

Done.

https://codereview.chromium.org/673183003/diff/1/extensions/common/csp_valida...
File extensions/common/csp_validator_unittest.cc (right):

https://codereview.chromium.org/673183003/diff/1/extensions/common/csp_valida...
extensions/common/csp_validator_unittest.cc:171: "default-src 'self'
https://s3.amazonaws.com", Manifest::TYPE_EXTENSION));
On 2014/10/24 22:16:52, kalman wrote:
> Isn't http://s3.amazonaws.com considered secure either way (before and after
your
> change)? Can you test something that is affected by the change and/or would
have
> been a regression?

You're right, I've removed the amazonaws.com exception. I mistakenly thought
that being a public suffix meant that it cannot be whitelisted.

[not at google - send to devlin, 2014-10-24 22:34:58]

lgtm

[robwu, 2014-10-24 22:36:52]

The CQ bit was checked by rob@robwu.nl

[commit-bot: I haz the power, 2014-10-24 22:40:57]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/673183003/20001

[commit-bot: I haz the power, 2014-10-24 23:51:18]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2014-10-24 23:51:19]

Try jobs failed on following builders:
  linux_chromium_rel on tryserver.chromium.linux
(http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

[robwu, 2014-10-25 08:50:18]

The CQ bit was checked by rob@robwu.nl

[commit-bot: I haz the power, 2014-10-25 08:50:38]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/673183003/40001

[commit-bot: I haz the power, 2014-10-25 09:42:41]

Committed patchset #3 (id:40001)

[commit-bot: I haz the power, 2014-10-25 09:43:34]

Patchset 3 (id:??) landed as
https://crrev.com/00c9de31dd87447dad58e6113ad47bbf3e3547ae
Cr-Commit-Position: refs/heads/master@{#301280}