Ignore insecure parts of CSP in extensions and allow extension to load

extensions/common/manifest_handlers/csp_info.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/common/manifest_handlers/csp_info.h"
 
 #include "base/memory/scoped_ptr.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/values.h"
 #include "extensions/common/csp_validator.h"
+#include "extensions/common/install_warning.h"
 #include "extensions/common/manifest_constants.h"
 #include "extensions/common/manifest_handlers/sandboxed_page_info.h"
 
 namespace extensions {
 
 namespace keys = manifest_keys;
 namespace errors = manifest_errors;
 
 using csp_validator::ContentSecurityPolicyIsLegal;
-using csp_validator::ContentSecurityPolicyIsSecure;
+using csp_validator::SanitizeContentSecurityPolicy;
 
 namespace {
 
 const char kDefaultContentSecurityPolicy[] =
-    "script-src 'self' chrome-extension-resource:; object-src 'self'";
+    "script-src 'self' chrome-extension-resource:; object-src 'self';";
 
 #define PLATFORM_APP_LOCAL_CSP_SOURCES \
     "'self' data: chrome-extension-resource:"
 const char kDefaultPlatformAppContentSecurityPolicy[] =
     // Platform apps can only use local resources by default.
     "default-src 'self' chrome-extension-resource:;"
     // For remote resources, they can fetch them via XMLHttpRequest.
-    "connect-src *;"
+    " connect-src *;"
     // And serve them via data: or same-origin (blob:, filesystem:) URLs
-    "style-src " PLATFORM_APP_LOCAL_CSP_SOURCES " 'unsafe-inline';"
-    "img-src " PLATFORM_APP_LOCAL_CSP_SOURCES ";"
-    "frame-src " PLATFORM_APP_LOCAL_CSP_SOURCES ";"
-    "font-src " PLATFORM_APP_LOCAL_CSP_SOURCES ";"
+    " style-src " PLATFORM_APP_LOCAL_CSP_SOURCES " 'unsafe-inline';"
+    " img-src " PLATFORM_APP_LOCAL_CSP_SOURCES ";"
+    " frame-src " PLATFORM_APP_LOCAL_CSP_SOURCES ";"
+    " font-src " PLATFORM_APP_LOCAL_CSP_SOURCES ";"
     // Media can be loaded from remote resources since:
     // 1. <video> and <audio> have good fallback behavior when offline or under
     //    spotty connectivity.
     // 2. Fetching via XHR and serving via blob: URLs currently does not allow
     //    streaming or partial buffering.
-    "media-src *;";
+    " media-src *;";
 
 int GetValidatorOptions(Extension* extension) {
   int options = csp_validator::OPTIONS_NONE;
 
   // crbug.com/146487
   if (extension->GetType() == Manifest::TYPE_EXTENSION ||
       extension->GetType() == Manifest::TYPE_LEGACY_PACKAGED_APP) {
     options |= csp_validator::OPTIONS_ALLOW_UNSAFE_EVAL;
   }
 
@@ skipping 45 matching lines @@
 bool CSPHandler::Parse(Extension* extension, base::string16* error) {
   const std::string key = Keys()[0];
   if (!extension->manifest()->HasPath(key)) {
     if (extension->manifest_version() >= 2) {
       // TODO(abarth): Should we continue to let extensions override the
       //               default Content-Security-Policy?
       std::string content_security_policy = is_platform_app_ ?
           kDefaultPlatformAppContentSecurityPolicy :
           kDefaultContentSecurityPolicy;
 
-      CHECK(ContentSecurityPolicyIsSecure(content_security_policy,
-                                          GetValidatorOptions(extension)));
+      CHECK_EQ(content_security_policy,
+               SanitizeContentSecurityPolicy(content_security_policy,
+                                             GetValidatorOptions(extension),
+                                             NULL));
       extension->SetManifestData(keys::kContentSecurityPolicy,
                                  new CSPInfo(content_security_policy));
     }
     return true;
   }
 
   std::string content_security_policy;
   if (!extension->manifest()->GetString(key, &content_security_policy)) {
     *error = base::ASCIIToUTF16(errors::kInvalidContentSecurityPolicy);
     return false;
   }
   if (!ContentSecurityPolicyIsLegal(content_security_policy)) {
     *error = base::ASCIIToUTF16(errors::kInvalidContentSecurityPolicy);
     return false;
   }
-  if (extension->manifest_version() >= 2 &&
-      !ContentSecurityPolicyIsSecure(content_security_policy,
-                                     GetValidatorOptions(extension))) {
-    *error = base::ASCIIToUTF16(errors::kInsecureContentSecurityPolicy);
-    return false;
+  std::string sanitized_csp;
+  if (extension->manifest_version() >= 2) {
+    std::vector<InstallWarning> warnings;
+    content_security_policy =
+        SanitizeContentSecurityPolicy(content_security_policy,
+                                      GetValidatorOptions(extension),
+                                      &warnings);
+    extension->AddInstallWarnings(warnings);
   }
 
   extension->SetManifestData(keys::kContentSecurityPolicy,
                              new CSPInfo(content_security_policy));
   return true;
 }
 
 bool CSPHandler::AlwaysParseForType(Manifest::Type type) const {
   if (is_platform_app_)
     return type == Manifest::TYPE_PLATFORM_APP;
   else
     return type == Manifest::TYPE_EXTENSION ||
         type == Manifest::TYPE_LEGACY_PACKAGED_APP;
 }
 
 const std::vector<std::string> CSPHandler::Keys() const {
   const std::string& key = is_platform_app_ ?
       keys::kPlatformAppContentSecurityPolicy : keys::kContentSecurityPolicy;
   return SingleKey(key);
 }
 
 }  // namespace extensions