Added more useful message error message for plugin-types CSP directive.

Added more useful message error message for plugin-types CSP directive.

As pointed out in
http://lists.w3.org/Archives/Public/public-webappsec/2015Jan/0096.html,
it's a bit confusing for developers that 'none' is not a valid value for
the CSP directive plugin-types. It was suggested that an improved
console error message pointing developers to object-src might be
helpful. This adds such an error message if the plugin-types value is
set to 'none'.

Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=188320

[jww, 2015-01-13 01:36:28]

jww@chromium.org changed reviewers:
+ mkwst@chromium.org

[jww, 2015-01-13 01:36:28]

Mike, this is an improved error message for plugin-types as per the thread at
http://lists.w3.org/Archives/Public/public-webappsec/2015Jan/0096.html. Let me
know what you think.

[Mike West, 2015-01-13 06:55:08]

LGTM.

https://codereview.chromium.org/811703006/diff/20001/LayoutTests/http/tests/s...
File
LayoutTests/http/tests/security/contentSecurityPolicy/1.1/plugintypes-invalid-expected.txt
(right):

https://codereview.chromium.org/811703006/diff/20001/LayoutTests/http/tests/s...
LayoutTests/http/tests/security/contentSecurityPolicy/1.1/plugintypes-invalid-expected.txt:9:
CONSOLE ERROR: Invalid plugin type in 'plugin-types' Content Security Policy
directive: ''none''. Did you mean to set the object-src directive to 'none'?
The double ' is a little weird, but whatever. I don't have any better
suggestions. :)

[jww, 2015-01-13 18:08:29]

On 2015/01/13 06:55:08, Mike West wrote:
> LGTM.
> 
>
https://codereview.chromium.org/811703006/diff/20001/LayoutTests/http/tests/s...
> File
>
LayoutTests/http/tests/security/contentSecurityPolicy/1.1/plugintypes-invalid-expected.txt
> (right):
> 
>
https://codereview.chromium.org/811703006/diff/20001/LayoutTests/http/tests/s...
>
LayoutTests/http/tests/security/contentSecurityPolicy/1.1/plugintypes-invalid-expected.txt:9:
> CONSOLE ERROR: Invalid plugin type in 'plugin-types' Content Security Policy
> directive: ''none''. Did you mean to set the object-src directive to 'none'?
> The double ' is a little weird, but whatever. I don't have any better
> suggestions. :)

I agree that it's weird, although it's already the case that if you use 'none'
you'd get double ' in the error message.

[jww, 2015-01-13 18:08:33]

The CQ bit was checked by jww@chromium.org

[commit-bot: I haz the power, 2015-01-13 18:09:16]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/811703006/20001

[commit-bot: I haz the power, 2015-01-13 19:23:39]

Committed patchset #2 (id:20001) as
https://src.chromium.org/viewvc/blink?view=rev&revision=188320