Added check to prevent extensions from injecting scrips into other extensions

chrome/common/extensions/extension.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/extensions/extension.h"
 
 #include <ostream>
 
 #include "base/base64.h"
 #include "base/basictypes.h"
@@ skipping 3557 matching lines @@
 
   if (browser_action())
     ++num_surfaces;
 
   if (is_app())
     ++num_surfaces;
 
   return num_surfaces > 1;
 }
 
-bool Extension::CanExecuteScriptOnPage(const GURL& page_url,
+bool Extension::CanExecuteScriptOnPage(const GURL& document_url,
+                                       const GURL& top_frame_url,
                                        int tab_id,
                                        const UserScript* script,
                                        std::string* error) const {
   base::AutoLock auto_lock(runtime_data_lock_);
   // The gallery is special-cased as a restricted URL for scripting to prevent
   // access to special JS bindings we expose to the gallery (and avoid things
   // like extensions removing the "report abuse" link).
   // TODO(erikkay): This seems like the wrong test.  Shouldn't we we testing
   // against the store app extent?
   GURL store_url(extension_urls::GetWebstoreLaunchURL());
-  if ((page_url.host() == store_url.host()) &&
+  if ((document_url.host() == store_url.host()) &&
       !CanExecuteScriptEverywhere() &&
       !CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kAllowScriptingGallery)) {
     if (error)
       *error = errors::kCannotScriptGallery;
     return false;
   }
 
-  if (page_url.SchemeIs(chrome::kChromeUIScheme) &&
-      !CanExecuteScriptEverywhere())
+  if (document_url.SchemeIs(chrome::kChromeUIScheme) &&
+      !CanExecuteScriptEverywhere()) {
     return false;
+  }
+
+  if (top_frame_url.SchemeIs(chrome::kExtensionScheme) &&
+      top_frame_url.GetOrigin() !=
+          GetBaseURLFromExtensionId(id()).GetOrigin() &&
+      !CanExecuteScriptEverywhere()) {
+    return false;
+  }
 
   // If a tab ID is specified, try the tab-specific permissions.
   if (tab_id >= 0) {
     scoped_refptr<const PermissionSet> tab_permissions =
         runtime_data_.GetTabSpecificPermissions(tab_id);
     if (tab_permissions.get() &&
-        tab_permissions->explicit_hosts().MatchesSecurityOrigin(page_url)) {
+        tab_permissions->explicit_hosts().MatchesSecurityOrigin(document_url)) {
       return true;
     }
   }
 
   // If a script is specified, use its matches.
   if (script)
-    return script->MatchesURL(page_url);
+    return script->MatchesURL(document_url);
 
   // Otherwise, see if this extension has permission to execute script
   // programmatically on pages.
   if (runtime_data_.GetActivePermissions()->HasExplicitAccessToOrigin(
-          page_url))
+          document_url))
     return true;
 
   if (error) {
     *error = ExtensionErrorUtils::FormatErrorMessage(errors::kCannotAccessPage,
-                                                     page_url.spec());
+                                                     document_url.spec());
   }
 
   return false;
 }
 
 bool Extension::ShowConfigureContextMenus() const {
   // Don't show context menu for component extensions. We might want to show
   // options for component extension button but now there is no component
   // extension with options. All other menu items like uninstall have
   // no sense for component extensions.
@@ skipping 292 matching lines @@
 
 UpdatedExtensionPermissionsInfo::UpdatedExtensionPermissionsInfo(
     const Extension* extension,
     const PermissionSet* permissions,
     Reason reason)
     : reason(reason),
       extension(extension),
       permissions(permissions) {}
 
 }   // namespace extensions