Extension resources should only load in contexts the extension has permission to access.

chrome/common/extensions/extension.h

Index: chrome/common/extensions/extension.h
diff --git a/chrome/common/extensions/extension.h b/chrome/common/extensions/extension.h
index 21881ee5d8c3bb81e4a5c9d0b785fe64885b8cd9..4d7ccee14c6b4d2550101257fbb582f0cc2947e0 100644
--- a/chrome/common/extensions/extension.h
+++ b/chrome/common/extensions/extension.h
@@ -354,6 +354,9 @@ class Extension : public base::RefCountedThreadSafe<Extension> {
   // Returns true if the specified resource is web accessible.
   bool IsResourceWebAccessible(const std::string& relative_path) const;
 
+  // Returns true if the specified resource is a NaCl module.
+  bool IsResourceNaClModule(const std::string& resource) const;

[Aaron Boodman, 2012/08/01 21:56:54]

IsResourceNaclManifest()? To distinguish from actual nexes?

Same comment below.

+
   // Returns true if the specified page is sandboxed (served in a unique
   // origin).
   bool IsSandboxedPage(const std::string& relative_path) const;
@@ -366,6 +369,9 @@ class Extension : public base::RefCountedThreadSafe<Extension> {
   // Returns true when 'web_accessible_resources' are defined for the extension.
   bool HasWebAccessibleResources() const;
 
+  // Returns true when 'nacl_modules' are defined for the extension.
+  bool HasNaClModules() const;
+
   // Returns an extension resource object. |relative_path| should be UTF8
   // encoded.
   ExtensionResource GetResource(const std::string& relative_path) const;