Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(247)

Unified Diff: extensions/common/manifest_handlers/csp_info.cc

Issue 747403002: Ignore insecure parts of CSP in extensions and allow extension to load (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Created 6 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: extensions/common/manifest_handlers/csp_info.cc
diff --git a/extensions/common/manifest_handlers/csp_info.cc b/extensions/common/manifest_handlers/csp_info.cc
index 2fd74fb76b272a096eae2e8f215861835955aeb6..f3fe79c3aa73321fa6e2e7b5de2a845ceb03535e 100644
--- a/extensions/common/manifest_handlers/csp_info.cc
+++ b/extensions/common/manifest_handlers/csp_info.cc
@@ -9,6 +9,7 @@
#include "base/strings/utf_string_conversions.h"
#include "base/values.h"
#include "extensions/common/csp_validator.h"
+#include "extensions/common/install_warning.h"
#include "extensions/common/manifest_constants.h"
#include "extensions/common/manifest_handlers/sandboxed_page_info.h"
@@ -88,7 +89,7 @@ bool CSPHandler::Parse(Extension* extension, base::string16* error) {
kDefaultContentSecurityPolicy;
CHECK(ContentSecurityPolicyIsSecure(content_security_policy,
- extension->GetType()));
+ extension->GetType(), NULL, NULL));
extension->SetManifestData(keys::kContentSecurityPolicy,
new CSPInfo(content_security_policy));
}
@@ -104,11 +105,14 @@ bool CSPHandler::Parse(Extension* extension, base::string16* error) {
*error = base::ASCIIToUTF16(errors::kInvalidContentSecurityPolicy);
return false;
}
+ std::string sanitized_csp;
+ std::vector<InstallWarning> warnings;
if (extension->manifest_version() >= 2 &&
!ContentSecurityPolicyIsSecure(content_security_policy,
- extension->GetType())) {
- *error = base::ASCIIToUTF16(errors::kInsecureContentSecurityPolicy);
- return false;
+ extension->GetType(), &sanitized_csp,
+ &warnings)) {
+ extension->AddInstallWarnings(warnings);
+ content_security_policy = sanitized_csp;
}
extension->SetManifestData(keys::kContentSecurityPolicy,
« extensions/common/csp_validator.cc ('K') | « extensions/common/manifest_constants.cc ('k') | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698