Refactored extension privilege enumeration and implemented URLPattern compari...

chrome/browser/extensions/extension_protocols.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/extension_protocols.h"
 
 #include <algorithm>
 
 #include "app/resource_bundle.h"
 #include "base/file_path.h"
@@ skipping 56 matching lines @@
 
 }  // namespace
 
 // Factory registered with URLRequest to create URLRequestJobs for extension://
 // URLs.
 static URLRequestJob* CreateExtensionURLRequestJob(URLRequest* request,
                                                    const std::string& scheme) {
   ChromeURLRequestContext* context =
       static_cast<ChromeURLRequestContext*>(request->context());
 
-  // Don't allow toplevel navigations to extension resources in incognito mode.
-  // This is because an extension must run in a single process, and an incognito
-  // tab prevents that.
-  // TODO(mpcomplete): better error code.
   const ResourceDispatcherHostRequestInfo* info =
       ResourceDispatcherHost::InfoForRequest(request);
+
+  // Don't allow extension resources to be loaded from origins which are not
+  // present in the extension's effective host permissions with the exception
+  // of empty origins and extension schemes.
+  if (!info->frame_origin().empty() &&
+      !GURL(info->frame_origin()).SchemeIs(chrome::kExtensionScheme)) {
+    ExtensionExtent host_permissions =
+      context->GetEffectiveHostPermissionsForExtension(request->url().host());
+    if (!host_permissions.ContainsURL(GURL(info->frame_origin())))
+      return new URLRequestErrorJob(request, net::ERR_ADDRESS_UNREACHABLE);
+  }
+
+  // Don't allow toplevel navigations to extension resources in incognito mode.
+  // This is because an extension must run in a single process, and an
+  // incognito tab prevents that.
+  // TODO(mpcomplete): better error code.
   if (context->is_off_the_record() &&
       info && info->resource_type() == ResourceType::MAIN_FRAME)
     return new URLRequestErrorJob(request, net::ERR_ADDRESS_UNREACHABLE);
 
   // chrome-extension://extension-id/resource/path.js
   const std::string& extension_id = request->url().host();
   FilePath directory_path = context->GetPathForExtension(extension_id);
   if (directory_path.value().empty()) {
     LOG(WARNING) << "Failed to GetPathForExtension: " << extension_id;
     return NULL;
@@ skipping 47 matching lines @@
 
   return new URLRequestFileJob(request, resource.GetFilePath());
 }
 
 void RegisterExtensionProtocols() {
   URLRequest::RegisterProtocolFactory(chrome::kExtensionScheme,
                                       &CreateExtensionURLRequestJob);
   URLRequest::RegisterProtocolFactory(chrome::kUserScriptScheme,
                                       &CreateUserScriptURLRequestJob);
 }