Only allow insecure object-src directives for whitelisted mime types

extensions/common/manifest_handlers/csp_info.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/common/manifest_handlers/csp_info.h"
 
 #include "base/memory/scoped_ptr.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/values.h"
@@ skipping 26 matching lines @@
     "img-src " PLATFORM_APP_LOCAL_CSP_SOURCES ";"
     "frame-src " PLATFORM_APP_LOCAL_CSP_SOURCES ";"
     "font-src " PLATFORM_APP_LOCAL_CSP_SOURCES ";"
     // Media can be loaded from remote resources since:
     // 1. <video> and <audio> have good fallback behavior when offline or under
     //    spotty connectivity.
     // 2. Fetching via XHR and serving via blob: URLs currently does not allow
     //    streaming or partial buffering.
     "media-src *;";
 
+int GetValidatorOptions(Extension* extension) {
+  int options = csp_validator::OPTIONS_NONE;
+
+  // crbug.com/146487
+  if (extension->GetType() == Manifest::TYPE_EXTENSION ||
+      extension->GetType() == Manifest::TYPE_LEGACY_PACKAGED_APP) {
+    options |= csp_validator::OPTIONS_ALLOW_UNSAFE_EVAL;
+  }
+
+  // Component extensions can specify an insecure object-src directive. This
+  // should be safe because non-NPAPI plugins should load in a sandboxed process
+  // and only allow communication via postMessage. Flash is an exception since
+  // it allows scripting into the embedder page, but even then it should
+  // disallow cross-origin scripting. At some point we may want to consider
+  // allowing this publicly.

[Mike West, 2014/11/25 13:42:36]

What conditions will have to be met to allow this publicly? If we consider PDF
and PNaCl "safe enough" for component extensions, we should probably consider
them safe enough for normal extensions as well.

That's a policy question for kalman@ et al, however. Not something that this CL
needs to address.

[raymes, 2014/11/25 13:51:05]

From my understanding of things, this would be reasonable to allow publicly
as-is but it would probably be best for someone on security to sign off on that
:)

+  if (extensions::Manifest::IsComponentLocation(extension->location()))
+    options |= csp_validator::OPTIONS_ALLOW_INSECURE_OBJECT_SRC;
+
+  return options;
+}
+
 }  // namespace
 
 CSPInfo::CSPInfo(const std::string& security_policy)
     : content_security_policy(security_policy) {
 }
 
 CSPInfo::~CSPInfo() {
 }
 
 // static
@@ skipping 24 matching lines @@
   const std::string key = Keys()[0];
   if (!extension->manifest()->HasPath(key)) {
     if (extension->manifest_version() >= 2) {
       // TODO(abarth): Should we continue to let extensions override the
       //               default Content-Security-Policy?
       std::string content_security_policy = is_platform_app_ ?
           kDefaultPlatformAppContentSecurityPolicy :
           kDefaultContentSecurityPolicy;
 
       CHECK(ContentSecurityPolicyIsSecure(content_security_policy,
-                                          extension->GetType()));
+                                          GetValidatorOptions(extension)));
       extension->SetManifestData(keys::kContentSecurityPolicy,
                                  new CSPInfo(content_security_policy));
     }
     return true;
   }
 
   std::string content_security_policy;
   if (!extension->manifest()->GetString(key, &content_security_policy)) {
     *error = base::ASCIIToUTF16(errors::kInvalidContentSecurityPolicy);
     return false;
   }
   if (!ContentSecurityPolicyIsLegal(content_security_policy)) {
     *error = base::ASCIIToUTF16(errors::kInvalidContentSecurityPolicy);
     return false;
   }
   if (extension->manifest_version() >= 2 &&
       !ContentSecurityPolicyIsSecure(content_security_policy,
-                                     extension->GetType())) {
+                                     GetValidatorOptions(extension))) {
     *error = base::ASCIIToUTF16(errors::kInsecureContentSecurityPolicy);
     return false;
   }
 
   extension->SetManifestData(keys::kContentSecurityPolicy,
                              new CSPInfo(content_security_policy));
   return true;
 }
 
 bool CSPHandler::AlwaysParseForType(Manifest::Type type) const {
   if (is_platform_app_)
     return type == Manifest::TYPE_PLATFORM_APP;
   else
     return type == Manifest::TYPE_EXTENSION ||
         type == Manifest::TYPE_LEGACY_PACKAGED_APP;
 }
 
 const std::vector<std::string> CSPHandler::Keys() const {
   const std::string& key = is_platform_app_ ?
       keys::kPlatformAppContentSecurityPolicy : keys::kContentSecurityPolicy;
   return SingleKey(key);
 }
 
 }  // namespace extensions