Make sure that a given app/extension requests only its own resources.

chrome/browser/extensions/api/api_resource_manager.h

Index: chrome/browser/extensions/api/api_resource_manager.h
diff --git a/chrome/browser/extensions/api/api_resource_manager.h b/chrome/browser/extensions/api/api_resource_manager.h
index ded4dd50d10ac2d8bb6721464fe6b5466f90d34f..f9f49c84d019ef9c08a5c7164674a5586b677228 100644
--- a/chrome/browser/extensions/api/api_resource_manager.h
+++ b/chrome/browser/extensions/api/api_resource_manager.h
@@ -10,6 +10,7 @@
 #include "base/memory/linked_ptr.h"
 #include "base/threading/non_thread_safe.h"
 #include "chrome/browser/profiles/profile_keyed_service.h"
+#include "chrome/common/extensions/extension.h"

[Mihai Parparita -not on Chrome, 2012/09/11 07:18:19]

This include seems unncessary (you're just dealing with extension IDs directly
in this file)

 #include "content/public/browser/browser_thread.h"
 
 using content::BrowserThread;
@@ -51,15 +52,16 @@ class ApiResourceManager : public ProfileKeyedService,
     return 0;
   }
 
-  void Remove(int api_resource_id) {
+  void Remove(const std::string& extension_id, int api_resource_id) {
     DCHECK(BrowserThread::CurrentlyOn(thread_id_));
-    api_resource_map_->erase(api_resource_id);
+    if (GetOwnedResource(extension_id, api_resource_id) != NULL) {
+      api_resource_map_->erase(api_resource_id);
+    }
   }
 
-  T* Get(int api_resource_id) {
+  T* Get(const std::string& extension_id, int api_resource_id) {
     DCHECK(BrowserThread::CurrentlyOn(thread_id_));
-    linked_ptr<T> ptr = (*api_resource_map_)[api_resource_id];
-    return ptr.get();
+    return GetOwnedResource(extension_id, api_resource_id);
   }
 
  private:
@@ -69,6 +71,16 @@ class ApiResourceManager : public ProfileKeyedService,
     return next_id_++;
   }
 
+  T* GetOwnedResource(const std::string& extension_id,
+                      int api_resource_id) {
+    linked_ptr<T> ptr = (*api_resource_map_)[api_resource_id];
+    T* resource = ptr.get();
+    if (resource &&
+        extension_id == resource->owner_extension_id())

[Mihai Parparita -not on Chrome, 2012/09/11 07:18:19]

This can fit on the previous line.

+      return resource;
+    return NULL;
+  }
+
   int next_id_;
   BrowserThread::ID thread_id_;