Don't allow content scripts to execute on file:// urls....

chrome/common/extensions/extension.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/extensions/extension.h"
 
 #include "app/resource_bundle.h"
 #include "base/basictypes.h"
 #include "base/command_line.h"
 #include "base/file_path.h"
@@ skipping 229 matching lines @@
           IntToString(definition_index), IntToString(j));
       return false;
     }
 
     URLPattern pattern;
     if (!pattern.Parse(match_str)) {
       *error = ExtensionErrorUtils::FormatErrorMessage(errors::kInvalidMatch,
           IntToString(definition_index), IntToString(j));
       return false;
     }
+    std::string scheme = pattern.scheme();
+    if (scheme == "file") {
+      // No content scripts are allowed unless the command line override switch
+      // was provided.
+      if (!CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kEnableJsOnFileUrls)) {
+        *error = errors::kInvalidJsMatches;
+        return false;
+      }
+    }
 
     result->add_url_pattern(pattern);
   }
 
-  // include/exclude globs (mostly for Greasemonkey compat)
+  // Include/exclude globs (mostly for Greasemonkey compatibility).
   if (!LoadGlobsHelper(content_script, definition_index, keys::kIncludeGlobs,
                        error, &UserScript::add_glob, result)) {
       return false;
   }
 
   if (!LoadGlobsHelper(content_script, definition_index, keys::kExcludeGlobs,
                        error, &UserScript::add_exclude_glob, result)) {
       return false;
   }
 
-  // js and css keys
+  // js and css keys.
   ListValue* js = NULL;
   if (content_script->HasKey(keys::kJs) &&
       !content_script->GetList(keys::kJs, &js)) {
     *error = ExtensionErrorUtils::FormatErrorMessage(errors::kInvalidJsList,
         IntToString(definition_index));
     return false;
   }
 
   ListValue* css = NULL;
   if (content_script->HasKey(keys::kCss) &&
@@ skipping 969 matching lines @@
     UserScript::PatternList::const_iterator pattern =
         content_script->url_patterns().begin();
     for (; pattern != content_script->url_patterns().end(); ++pattern) {
       if (pattern->match_subdomains() && pattern->host().empty())
         return true;
     }
   }
 
   return false;
 }