Allow *.googleapis.com to be used in CSP

extensions/common/csp_validator_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/common/csp_validator.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 using extensions::csp_validator::ContentSecurityPolicyIsLegal;
 using extensions::csp_validator::ContentSecurityPolicyIsSecure;
 using extensions::csp_validator::ContentSecurityPolicyIsSandboxed;
@@ skipping 144 matching lines @@
   EXPECT_TRUE(ContentSecurityPolicyIsSecure(
       "default-src 'self' blob:", Manifest::TYPE_EXTENSION));
   EXPECT_FALSE(ContentSecurityPolicyIsSecure(
       "default-src 'self' blob:http://example.com/XXX",
       Manifest::TYPE_EXTENSION));
   EXPECT_TRUE(ContentSecurityPolicyIsSecure(
       "default-src 'self' filesystem:", Manifest::TYPE_EXTENSION));
   EXPECT_FALSE(ContentSecurityPolicyIsSecure(
       "default-src 'self' filesystem:http://example.com/XXX",
       Manifest::TYPE_EXTENSION));
+
+  EXPECT_TRUE(ContentSecurityPolicyIsSecure(
+      "default-src 'self' https://*.googleapis.com", Manifest::TYPE_EXTENSION));
+  EXPECT_TRUE(ContentSecurityPolicyIsSecure(
+      "default-src 'self' https://x.googleapis.com", Manifest::TYPE_EXTENSION));
+  EXPECT_TRUE(ContentSecurityPolicyIsSecure(
+      "default-src 'self' https://s3.amazonaws.com", Manifest::TYPE_EXTENSION));

[not at google - send to devlin, 2014/10/24 22:16:52]

Isn't s3.amazonaws.com considered secure either way (before and after your
change)? Can you test something that is affected by the change and/or would have
been a regression?

[robwu, 2014/10/24 22:34:08]

You're right, I've removed the amazonaws.com exception. I mistakenly thought
that being a public suffix meant that it cannot be whitelisted.

 }
 
 TEST(ExtensionCSPValidator, IsSandboxed) {
   EXPECT_FALSE(ContentSecurityPolicyIsSandboxed(std::string(),
                                                 Manifest::TYPE_EXTENSION));
   EXPECT_FALSE(ContentSecurityPolicyIsSandboxed("img-src https://google.com",
                                                 Manifest::TYPE_EXTENSION));
 
   // Sandbox directive is required.
   EXPECT_TRUE(ContentSecurityPolicyIsSandboxed(
@@ skipping 15 matching lines @@
       "sandbox allow-top-navigation", Manifest::TYPE_EXTENSION));
   EXPECT_FALSE(ContentSecurityPolicyIsSandboxed(
       "sandbox allow-top-navigation", Manifest::TYPE_PLATFORM_APP));
 
   // Popups are OK.
   EXPECT_TRUE(ContentSecurityPolicyIsSandboxed(
       "sandbox allow-popups", Manifest::TYPE_EXTENSION));
   EXPECT_TRUE(ContentSecurityPolicyIsSandboxed(
       "sandbox allow-popups", Manifest::TYPE_PLATFORM_APP));
 }