Only allows extensions to create HTML notifications.

chrome/renderer/chrome_render_view_observer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/chrome_render_view_observer.h"
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/command_line.h"
 #include "base/debug/trace_event.h"
@@ skipping 501 matching lines @@
   // The <browser> tag is implemented via Shadow DOM.
   if (HasExtensionPermission(origin, APIPermission::kBrowserTag))
     return true;
 
   if (HasExtensionPermission(origin, APIPermission::kExperimental))
     return true;
 
   return false;
 }
 
+bool ChromeRenderViewObserver::allowHTMLNotifications(
+    const WebDocument& document) {
+  WebSecurityOrigin origin = document.securityOrigin();
+  return HasExtensionPermission(origin, APIPermission::kNotification);
+}
+
 static void SendInsecureContentSignal(int signal) {
   UMA_HISTOGRAM_ENUMERATION("SSL.InsecureContent", signal,
                             INSECURE_CONTENT_NUM_EVENTS);
 }
 
 bool ChromeRenderViewObserver::allowDisplayingInsecureContent(
     WebKit::WebFrame* frame,
     bool allowed_per_settings,
     const WebKit::WebSecurityOrigin& origin,
     const WebKit::WebURL& resource_url) {
@@ skipping 551 matching lines @@
         reinterpret_cast<const unsigned char*>(&data[0]);
 
     return decoder.Decode(src_data, data.size());
   }
   return SkBitmap();
 }
 
 bool ChromeRenderViewObserver::IsStrictSecurityHost(const std::string& host) {
   return (strict_security_hosts_.find(host) != strict_security_hosts_.end());
 }