Ignore insecure parts of CSP in extensions and allow extension to load

extensions/common/manifest_constants.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/common/manifest_constants.h"
 
 namespace extensions {
 
 namespace manifest_keys {
 
@@ skipping 290 matching lines @@
 const char kInvalidChromeURLOverrides[] =
     "Invalid value for 'chrome_url_overrides'.";
 const char kInvalidCommandsKey[] =
     "Invalid value for 'commands'.";
 const char kInvalidContentPack[] =
     "Invalid value for 'content_pack'.";
 const char kInvalidContentPackSites[] =
     "Invalid value for Content Pack sites - files must be strings.";
 const char kInvalidContentScript[] =
     "Invalid value for 'content_scripts[*]'.";
+const char kInvalidContentScriptsList[] =
+    "Invalid value for 'content_scripts'.";
 const char kInvalidContentSecurityPolicy[] =
     "Invalid value for 'content_security_policy'.";
-const char kInvalidContentScriptsList[] =
-    "Invalid value for 'content_scripts'.";
+const char kInvalidCSPInsecureValue[] =
+    "Ignored insecure CSP value \"*\" in directive '*'.";
+const char kInvalidCSPMissingSecureSrc[] =
+    "CSP directive '*' must be specified (either explicitly, or implicitly via"
+    " 'default-src') and must whitelist only secure resources.";
 const char kInvalidCss[] =
     "Invalid value for 'content_scripts[*].css[*]'.";
 const char kInvalidCssList[] =
     "Required value 'content_scripts[*].css' is invalid.";
 const char kInvalidDefaultLocale[] =
     "Invalid value for default locale - locale name must be a string.";
 const char kInvalidDescription[] =
     "Invalid value for 'description'.";
 const char kInvalidDevToolsPage[] =
     "Invalid value for 'devtools_page'.";
@@ skipping 290 matching lines @@
 const char kInvalidWebviewPartitionName[] =
     "Invalid value for 'webview.partitions[*].name'.";
 const char kInvalidWebviewPartitionsList[] =
     "Invalid value for 'webview.partitions'.";
 const char kInvalidWebURL[] =
     "Invalid value for 'app.urls[*]': *";
 const char kInvalidWebURLs[] =
     "Invalid value for 'app.urls'.";
 const char kInvalidZipHash[] =
     "Required key 'zip_hash' is missing or invalid.";
-const char kInsecureContentSecurityPolicy[] =
-    "Invalid value for 'content_security_policy': Both 'script-src' and"
-    " 'object-src' directives must be specified (either explicitly, or"
-    " implicitly via 'default-src'), and both must whitelist only secure"
-    " resources. You may include any of the following sources: \"'self'\","
-    " \"'unsafe-eval'\", \"http://127.0.0.1\", \"http://localhost\", or any"
-    " \"https://\" or \"chrome-extension://\" origin. For more information,"
-    " see http://developer.chrome.com/extensions/contentSecurityPolicy.html";
 const char kKeyIsDeprecatedWithReplacement[] =
     "Key \"*\" is deprecated.  Key \"*\" should be used instead.";
 const char kLauncherPagePageRequired[] =
     "The 'launcher_page.page' key is required.";
 const char kLaunchPathAndExtentAreExclusive[] =
     "The 'app.launch.local_path' and 'app.urls' keys cannot both be set.";
 const char kLaunchPathAndURLAreExclusive[] =
     "The 'app.launch.local_path' and 'app.launch.web_url' keys cannot "
     "both be set.";
 const char kLaunchURLRequired[] =
@@ skipping 48 matching lines @@
 const char kWebRequestConflictsWithLazyBackground[] =
     "The 'webRequest' API cannot be used with event pages.";
 #if defined(OS_CHROMEOS)
 const char kIllegalPlugins[] =
     "Extensions cannot install plugins on Chrome OS";
 #endif
 
 }  // namespace manifest_errors
 
 }  // namespace extensions