Allow *.googleapis.com to be used in CSP

extensions/common/csp_validator.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/common/csp_validator.h"
 
 #include <vector>
 
 #include "base/strings/string_split.h"
 #include "base/strings/string_tokenizer.h"
@@ skipping 69 matching lines @@
   }
 
   std::string host(url, start_of_host, end_of_host - start_of_host);
   // Global wildcards are not allowed.
   if (host.empty() || host.find("*") != std::string::npos)
     return false;
 
   if (!is_wildcard_subdomain || !should_check_rcd)
     return true;
 
+  // Allow *.googleapis.com to be whitelisted for backwards-compatibility.
+  // AWS has registered several public suffixes but hosts the user-generated
+  // content directly under the public suffix without a subdomain.

[not at google - send to devlin, 2014/10/24 22:16:51]

Reference that bug here. Also some examples in the comment would be good.

[robwu, 2014/10/24 22:34:08]

Done.

+  if (host == "googleapis.com" || EndsWith(host, ".amazonaws.com", true))
+    return true;
+
   // Wildcards on subdomains of a TLD are not allowed.
   size_t registry_length = net::registry_controlled_domains::GetRegistryLength(
       host,
       net::registry_controlled_domains::INCLUDE_UNKNOWN_REGISTRIES,
       net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES);
   return registry_length != 0;
 }
 
 bool HasOnlySecureTokens(base::StringTokenizer& tokenizer,
                          Manifest::Type type) {
@@ skipping 137 matching lines @@
       }
     }
   }
 
   return seen_sandbox;
 }
 
 }  // namespace csp_validator
 
 }  // namespace extensions