Use WebFrame::setIsolatedWorldSecurityOrigin to allow cross-origin XHRs in content scripts.

chrome/renderer/extensions/extension_dispatcher.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_RENDERER_EXTENSIONS_EXTENSION_DISPATCHER_H_
 #define CHROME_RENDERER_EXTENSIONS_EXTENSION_DISPATCHER_H_
 #pragma once
 
 #include <set>
 #include <string>
@@ skipping 34 matching lines @@
   const ExtensionSet* extensions() const { return &extensions_; }
   UserScriptSlave* user_script_slave() { return user_script_slave_.get(); }
 
   bool IsExtensionActive(const std::string& extension_id);
 
   // See WebKit::WebPermissionClient::allowScriptExtension
   bool AllowScriptExtension(WebKit::WebFrame* frame,
                             const std::string& v8_extension_name,
                             int extension_group);
 
+  // Sets up the host permissions for |extension|.
+  static void InitHostPermissions(const Extension* extension);
+
  private:
   friend class RenderViewTest;
 
   // RenderProcessObserver implementation:
   virtual bool OnControlMessageReceived(const IPC::Message& message);
   virtual void WebKitInitialized();
   virtual void IdleNotification();
 
   void OnMessageInvoke(const std::string& extension_id,
                        const std::string& function_name,
                        const ListValue& args,
                        const GURL& event_url);
   void OnSetFunctionNames(const std::vector<std::string>& names);
   void OnLoaded(const ExtensionMsg_Loaded_Params& params);
   void OnUnloaded(const std::string& id);
   void OnSetScriptingWhitelist(
       const Extension::ScriptingWhitelist& extension_ids);
   void OnPageActionsUpdated(const std::string& extension_id,
       const std::vector<std::string>& page_actions);
   void OnActivateExtension(const std::string& extension_id);
   void OnUpdateUserScripts(base::SharedMemoryHandle table);
 
   // Update the list of active extensions that will be reported when we crash.
   void UpdateActiveExtensions();
 
   // Calls RenderThread's RegisterExtension and keeps tracks of which v8
   // extension is for Chrome Extensions only.
   void RegisterExtension(v8::Extension* extension, bool restrict_to_extensions);
 
-  // Sets up the host permissions for |extension|.
-  void InitHostPermissions(const Extension* extension);
-
   // True if this renderer is running extensions.
   bool is_extension_process_;
 
   // Contains all loaded extensions.  This is essentially the renderer
   // counterpart to ExtensionService in the browser. It contains information
   // about all extensions currently loaded by the browser.
   ExtensionSet extensions_;
 
   scoped_ptr<UserScriptSlave> user_script_slave_;
 
@@ skipping 10 matching lines @@
   // The extensions that are active in this process.
   std::set<std::string> active_extension_ids_;
 
   // True once WebKit has been initialized (and it is therefore safe to poke).
   bool is_webkit_initialized_;
 
   DISALLOW_COPY_AND_ASSIGN(ExtensionDispatcher);
 };
 
 #endif  // CHROME_RENDERER_EXTENSIONS_EXTENSION_DISPATCHER_H_