Allow transitions to WebUI pages which are extension urls (new tab page is the relevant example).

chrome/renderer/extensions/extension_resource_request_policy.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/extensions/extension_resource_request_policy.h"
 
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "base/stringprintf.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/url_constants.h"
 #include "chrome/common/extensions/extension.h"
 #include "chrome/common/extensions/extension_set.h"
+#include "content/public/common/page_transition_types.h"
 #include "googleurl/src/gurl.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebConsoleMessage.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebDocument.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebFrame.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/platform/WebString.h"
 
 using extensions::Extension;
 
 // static
 bool ExtensionResourceRequestPolicy::CanRequestResource(
     const GURL& resource_url,
     WebKit::WebFrame* frame,
+    content::PageTransition transition_type,
     const ExtensionSet* loaded_extensions) {
   CHECK(resource_url.SchemeIs(chrome::kExtensionScheme));
 
   const Extension* extension =
       loaded_extensions->GetExtensionOrAppByURL(ExtensionURLInfo(resource_url));
   if (!extension) {
     // Allow the load in the case of a non-existent extension. We'll just get a
     // 404 from the browser process.
     return true;
   }
 
   // Disallow loading of packaged resources for hosted apps. We don't allow
   // hybrid hosted/packaged apps. The one exception is access to icons, since
   // some extensions want to be able to do things like create their own
   // launchers.
   std::string resource_root_relative_path =
       resource_url.path().empty() ? "" : resource_url.path().substr(1);
   if (extension->is_hosted_app() &&
       !extension->icons().ContainsPath(resource_root_relative_path)) {
     LOG(ERROR) << "Denying load of " << resource_url.spec() << " from "
                << "hosted app.";
     return false;
   }
 
   // Disallow loading of extension resources which are not explicitely listed

[Charlie Reis, 2012/08/02 18:39:26]

nit: explicitly (as long as we're cleaning stuff up)

   // as web accessible if the manifest version is 2 or greater.
   if (!extension->IsResourceWebAccessible(resource_url.path()) &&
       !CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kDisableExtensionsResourceWhitelist)) {
     GURL frame_url = frame->document().url();
     GURL page_url = frame->top()->document().url();
 
-    // Exceptions are:
-    // - empty origin (needed for some edge cases when we have empty origins)
-    bool is_empty_origin = frame_url.is_empty();
     // - extensions requesting their own resources (frame_url check is for
     //     images, page_url check is for iframes)
     bool is_own_resource = frame_url.GetOrigin() == extension->url() ||
         page_url.GetOrigin() == extension->url();
     // - devtools (chrome-extension:// URLs are loaded into frames of devtools
     //     to support the devtools extension APIs)
     bool is_dev_tools = page_url.SchemeIs(chrome::kChromeDevToolsScheme) &&
         !extension->devtools_url().is_empty();
+    // In all other cases we forbid certain types of transitions.

[Charlie Reis, 2012/08/02 18:39:26]

I don't quite follow this, with all the exceptions and negatives.  What's the
high level intention?  That certain types of page transitions should be allowed?
 Which ones?

[Cris Neckar, 2012/08/02 19:08:26]

Yes the intent was to ensure that certain types of page transitions are always
allowed. Namely anything that is not web triggerable (UI interaction etc).

Perhaps a helpers function in page_transition_types TransitionIsWebTriggerable()
or similar would be less prone to future breakage?

+    content::PageTransition base_transition =
+        PageTransitionStripQualifier(transition_type);
+    bool transition_allowed =
+        base_transition != content::PAGE_TRANSITION_LINK &&
+        base_transition != content::PAGE_TRANSITION_AUTO_SUBFRAME &&
+        base_transition != content::PAGE_TRANSITION_MANUAL_SUBFRAME &&
+        base_transition != content::PAGE_TRANSITION_FORM_SUBMIT;
 
-    if (!is_empty_origin && !is_own_resource && !is_dev_tools) {
+    if (!is_own_resource && !is_dev_tools && !transition_allowed) {
       std::string message = base::StringPrintf(
           "Denying load of %s. Resources must be listed in the "
           "web_accessible_resources manifest key in order to be loaded by "
           "pages outside the extension.",
           resource_url.spec().c_str());
       frame->addMessageToConsole(
           WebKit::WebConsoleMessage(WebKit::WebConsoleMessage::LevelError,
                                     WebKit::WebString::fromUTF8(message)));
       return false;
     }
@@ skipping 19 matching lines @@
         WebKit::WebConsoleMessage(WebKit::WebConsoleMessage::LevelError,
                                   WebKit::WebString::fromUTF8(message)));
     return false;
   }
 
   return true;
 }
 
 ExtensionResourceRequestPolicy::ExtensionResourceRequestPolicy() {
 }