Only allow insecure object-src directives for whitelisted mime types

extensions/common/csp_validator_unittest.cc

Index: extensions/common/csp_validator_unittest.cc
diff --git a/extensions/common/csp_validator_unittest.cc b/extensions/common/csp_validator_unittest.cc
index 9e2d800f99ea5fb799f3b1e3f953787837ed5117..1afa0b1a3f387f40d138e3df09215a6d7a2b9138 100644
--- a/extensions/common/csp_validator_unittest.cc
+++ b/extensions/common/csp_validator_unittest.cc
@@ -180,19 +180,34 @@ TEST(ExtensionCSPValidator, IsSecure) {
 
   EXPECT_FALSE(ContentSecurityPolicyIsSecure(
      "script-src 'self'; object-src *", OPTIONS_NONE));
-  EXPECT_TRUE(ContentSecurityPolicyIsSecure(
+  EXPECT_FALSE(ContentSecurityPolicyIsSecure(
      "script-src 'self'; object-src *", OPTIONS_ALLOW_INSECURE_OBJECT_SRC));
   EXPECT_TRUE(ContentSecurityPolicyIsSecure(
-     "script-src 'self'; object-src http://www.example.com",
+     "script-src 'self'; object-src *; plugin-types application/pdf",
+     OPTIONS_ALLOW_INSECURE_OBJECT_SRC));
+  EXPECT_FALSE(ContentSecurityPolicyIsSecure(
+     "script-src 'self'; object-src *; "
+     "plugin-types application/x-shockwave-flash",
+     OPTIONS_ALLOW_INSECURE_OBJECT_SRC));
+  EXPECT_FALSE(ContentSecurityPolicyIsSecure(
+     "script-src 'self'; object-src *; "
+     "plugin-types application/x-shockwave-flash application/pdf",
+     OPTIONS_ALLOW_INSECURE_OBJECT_SRC));
+  EXPECT_TRUE(ContentSecurityPolicyIsSecure(
+     "script-src 'self'; object-src http://www.example.com; "
+     "plugin-types application/pdf",
      OPTIONS_ALLOW_INSECURE_OBJECT_SRC));
   EXPECT_TRUE(ContentSecurityPolicyIsSecure(
-     "object-src http://www.example.com blob:; script-src 'self'",
+     "object-src http://www.example.com blob:; script-src 'self'; "
+     "plugin-types application/pdf",
      OPTIONS_ALLOW_INSECURE_OBJECT_SRC));
   EXPECT_TRUE(ContentSecurityPolicyIsSecure(
-     "script-src 'self'; object-src http://*.example.com",
+     "script-src 'self'; object-src http://*.example.com; "
+     "plugin-types application/pdf",
      OPTIONS_ALLOW_INSECURE_OBJECT_SRC));
   EXPECT_FALSE(ContentSecurityPolicyIsSecure(
-     "script-src *; object-src *;", OPTIONS_ALLOW_INSECURE_OBJECT_SRC));
+     "script-src *; object-src *; plugin-types application/pdf",
+     OPTIONS_ALLOW_INSECURE_OBJECT_SRC));
 }
 
 TEST(ExtensionCSPValidator, IsSandboxed) {