Extension resources should only load in contexts the extension has permission to access.

chrome/common/extensions/extension.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_COMMON_EXTENSIONS_EXTENSION_H_
 #define CHROME_COMMON_EXTENSIONS_EXTENSION_H_
 
 #include <algorithm>
 #include <iosfwd>
 #include <map>
@@ skipping 336 matching lines @@
     return GetResourceURL(url(), relative_path);
   }
 
   // Returns true if the resource matches a pattern in the pattern_set.
   bool ResourceMatches(const URLPatternSet& pattern_set,
                        const std::string& resource) const;
 
   // Returns true if the specified resource is web accessible.
   bool IsResourceWebAccessible(const std::string& relative_path) const;
 
+  // Returns true if the specified resource is a NaCl module.
+  bool IsResourceNaClModule(const std::string& resource) const;

[Aaron Boodman, 2012/08/01 21:56:54]

IsResourceNaclManifest()? To distinguish from actual nexes?

Same comment below.

+
   // Returns true if the specified page is sandboxed (served in a unique
   // origin).
   bool IsSandboxedPage(const std::string& relative_path) const;
 
   // Returns the Content Security Policy that the specified resource should be
   // served with.
   std::string GetResourceContentSecurityPolicy(const std::string& relative_path)
       const;
 
   // Returns true when 'web_accessible_resources' are defined for the extension.
   bool HasWebAccessibleResources() const;
 
+  // Returns true when 'nacl_modules' are defined for the extension.
+  bool HasNaClModules() const;
+
   // Returns an extension resource object. |relative_path| should be UTF8
   // encoded.
   ExtensionResource GetResource(const std::string& relative_path) const;
 
   // As above, but with |relative_path| following the file system's encoding.
   ExtensionResource GetResource(const FilePath& relative_path) const;
 
   // |input| is expected to be the text of an rsa public or private key. It
   // tolerates the presence or absence of bracking header/footer like this:
   //     -----(BEGIN|END) [RSA PUBLIC/PRIVATE] KEY-----
@@ skipping 801 matching lines @@
 
   UpdatedExtensionPermissionsInfo(
       const Extension* extension,
       const PermissionSet* permissions,
       Reason reason);
 };
 
 } // namespace extensions
 
 #endif  // CHROME_COMMON_EXTENSIONS_EXTENSION_H_