Allow arbitrary object-src CSP directives for component extensions

extensions/common/manifest_handlers/csp_info.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/common/manifest_handlers/csp_info.h"
 
 #include "base/memory/scoped_ptr.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/values.h"
@@ skipping 26 matching lines @@
     "img-src " PLATFORM_APP_LOCAL_CSP_SOURCES ";"
     "frame-src " PLATFORM_APP_LOCAL_CSP_SOURCES ";"
     "font-src " PLATFORM_APP_LOCAL_CSP_SOURCES ";"
     // Media can be loaded from remote resources since:
     // 1. <video> and <audio> have good fallback behavior when offline or under
     //    spotty connectivity.
     // 2. Fetching via XHR and serving via blob: URLs currently does not allow
     //    streaming or partial buffering.
     "media-src *;";
 
+int GetValidatorOptions(Extension* extension) {
+  int options = csp_validator::NO_OPTIONS;
+
+  // crbug.com/146487
+  if (extension->GetType() == Manifest::TYPE_EXTENSION ||
+      extension->GetType() == Manifest::TYPE_LEGACY_PACKAGED_APP) {
+    options |= csp_validator::ALLOW_UNSAFE_EVAL;
+  }
+
+  // Component extensions can specify an insecure object-src directive. This
+  // should be safe because non-NPAPI plugins should load in a sandboxed process
+  // and only allow communication via postMessage. Flash is an exception since
+  // it allows scripting into the embedder page, but even then it should
+  // disallow cross-origin scripting. At some point we may want to consider
+  // allowing this publicly.
+  if (extensions::Manifest::IsComponentLocation(extension->location()))
+    options |= csp_validator::ALLOW_INSECURE_OBJECT_SRC;
+
+  return options;
+}
+
 }  // namespace
 
 CSPInfo::CSPInfo(const std::string& security_policy)
     : content_security_policy(security_policy) {
 }
 
 CSPInfo::~CSPInfo() {
 }
 
 // static
@@ skipping 24 matching lines @@
   const std::string key = Keys()[0];
   if (!extension->manifest()->HasPath(key)) {
     if (extension->manifest_version() >= 2) {
       // TODO(abarth): Should we continue to let extensions override the
       //               default Content-Security-Policy?
       std::string content_security_policy = is_platform_app_ ?
           kDefaultPlatformAppContentSecurityPolicy :
           kDefaultContentSecurityPolicy;
 
       CHECK(ContentSecurityPolicyIsSecure(content_security_policy,
-                                          extension->GetType()));
+                                          GetValidatorOptions(extension)));
       extension->SetManifestData(keys::kContentSecurityPolicy,
                                  new CSPInfo(content_security_policy));
     }
     return true;
   }
 
   std::string content_security_policy;
   if (!extension->manifest()->GetString(key, &content_security_policy)) {
     *error = base::ASCIIToUTF16(errors::kInvalidContentSecurityPolicy);
     return false;
   }
   if (!ContentSecurityPolicyIsLegal(content_security_policy)) {
     *error = base::ASCIIToUTF16(errors::kInvalidContentSecurityPolicy);
     return false;
   }
   if (extension->manifest_version() >= 2 &&
       !ContentSecurityPolicyIsSecure(content_security_policy,
-                                     extension->GetType())) {
+                                     GetValidatorOptions(extension))) {
     *error = base::ASCIIToUTF16(errors::kInsecureContentSecurityPolicy);
     return false;
   }
 
   extension->SetManifestData(keys::kContentSecurityPolicy,
                              new CSPInfo(content_security_policy));
   return true;
 }
 
 bool CSPHandler::AlwaysParseForType(Manifest::Type type) const {
   if (is_platform_app_)
     return type == Manifest::TYPE_PLATFORM_APP;
   else
     return type == Manifest::TYPE_EXTENSION ||
         type == Manifest::TYPE_LEGACY_PACKAGED_APP;
 }
 
 const std::vector<std::string> CSPHandler::Keys() const {
   const std::string& key = is_platform_app_ ?
       keys::kPlatformAppContentSecurityPolicy : keys::kContentSecurityPolicy;
   return SingleKey(key);
 }
 
 }  // namespace extensions