Added check to prevent extensions from injecting scrips into other extensions

chrome/renderer/extensions/user_script_scheduler.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/extensions/user_script_scheduler.h"
 
 #include "base/bind.h"
 #include "base/message_loop.h"
 #include "chrome/common/extensions/extension_error_utils.h"
 #include "chrome/common/extensions/extension_manifest_constants.h"
@@ skipping 143 matching lines @@
     return;
   }
 
   std::vector<WebFrame*> frame_vector;
   frame_vector.push_back(frame_);
   if (params.all_frames)
     GetAllChildFrames(frame_, &frame_vector);
 
   for (std::vector<WebFrame*>::iterator frame_it = frame_vector.begin();
        frame_it != frame_vector.end(); ++frame_it) {
-    WebFrame* frame = *frame_it;
+    WebFrame* child_frame = *frame_it;
     if (params.is_javascript) {
       // We recheck access here in the renderer for extra safety against races
       // with navigation.
       //
       // But different frames can have different URLs, and the extension might
       // only have access to a subset of them. For the top frame, we can
       // immediately send an error and stop because the browser process
       // considers that an error too.
       //
       // For child frames, we just skip ones the extension doesn't have access
       // to and carry on.
-      if (!extension->CanExecuteScriptOnPage(frame->document().url(),
+      if (!extension->CanExecuteScriptOnPage(child_frame->document().url(),
+                                             frame_->document().url(),
                                              extension_helper->tab_id(),
                                              NULL,
                                              NULL)) {
-        if (frame->parent()) {
+        if (child_frame->parent()) {
           continue;
         } else {
           render_view->Send(new ExtensionHostMsg_ExecuteCodeFinished(
               render_view->GetRoutingID(),
               params.request_id,
               ExtensionErrorUtils::FormatErrorMessage(
                   extension_manifest_errors::kCannotAccessPage,
-                  frame->document().url().spec()),
+                  child_frame->document().url().spec()),
               -1,
               GURL(""),
               execution_results));
           return;
         }
       }
 
       WebScriptSource source(WebString::fromUTF8(params.code));
       v8::HandleScope scope;
       v8::Persistent<v8::Context> persistent_context = v8::Context::New();
       v8::Local<v8::Context> context =
           v8::Local<v8::Context>::New(persistent_context);
       persistent_context.Dispose();
 
       scoped_ptr<content::V8ValueConverter> v8_converter(
           content::V8ValueConverter::create());
       v8_converter->SetUndefinedAllowed(true);
       v8::Handle<v8::Value> script_value;
       if (params.in_main_world) {
-        script_value = frame->executeScriptAndReturnValue(source);
+        script_value = child_frame->executeScriptAndReturnValue(source);
       } else {
         WebKit::WebVector<v8::Local<v8::Value> > results;
         std::vector<WebScriptSource> sources;
         sources.push_back(source);
-        frame->executeScriptInIsolatedWorld(
+        child_frame->executeScriptInIsolatedWorld(
             dispatcher_->user_script_slave()->
-                GetIsolatedWorldIdForExtension(extension, frame),
+                GetIsolatedWorldIdForExtension(extension, child_frame),
             &sources.front(), sources.size(), EXTENSION_GROUP_CONTENT_SCRIPTS,
             &results);
         // We only expect one value back since we only pushed one source
         if (results.size() == 1 && !results[0].IsEmpty())
           script_value = results[0];
       }
       if (!script_value.IsEmpty()) {
         base::Value* base_val =
             v8_converter->FromV8Value(script_value, context);
         execution_results.Append(base_val);
         script_value.Clear();
       }
     } else {
-      frame->document().insertUserStyleSheet(
+      child_frame->document().insertUserStyleSheet(
           WebString::fromUTF8(params.code),
           // Author level is consistent with WebView::addUserStyleSheet.
           WebDocument::UserStyleAuthorLevel);
     }
   }
 
   render_view->Send(new ExtensionHostMsg_ExecuteCodeFinished(
       render_view->GetRoutingID(),
       params.request_id,
       "",  // no error
@@ skipping 10 matching lines @@
 
   for (WebFrame* child_frame = parent_frame->firstChild(); child_frame;
        child_frame = child_frame->nextSibling()) {
     frames_vector->push_back(child_frame);
     GetAllChildFrames(child_frame, frames_vector);
   }
   return true;
 }
 
 }  // namespace extensions