Use WebFrame::setIsolatedWorldSecurityOrigin to allow cross-origin XHRs in content scripts.

chrome/renderer/extensions/user_script_slave.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/extensions/user_script_slave.h"
 
 #include <map>
 
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "base/perftimer.h"
 #include "base/pickle.h"
 #include "base/shared_memory.h"
 #include "base/metrics/histogram.h"
 #include "base/stringprintf.h"
 #include "chrome/common/extensions/extension.h"
 #include "chrome/common/extensions/extension_set.h"
 #include "chrome/common/url_constants.h"
 #include "chrome/renderer/chrome_render_process_observer.h"
+#include "chrome/renderer/extensions/extension_dispatcher.h"
 #include "chrome/renderer/extensions/extension_groups.h"
 #include "googleurl/src/gurl.h"
 #include "grit/renderer_resources.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebFrame.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebSecurityOrigin.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebSecurityPolicy.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebVector.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebView.h"
 #include "ui/base/resource/resource_bundle.h"
 
 using WebKit::WebFrame;
+using WebKit::WebSecurityOrigin;
+using WebKit::WebSecurityPolicy;
 using WebKit::WebString;
 using WebKit::WebVector;
 using WebKit::WebView;
 
 // These two strings are injected before and after the Greasemonkey API and
 // user script to wrap it in an anonymous scope.
 static const char kUserScriptHead[] = "(function (unsafeWindow) {\n";
 static const char kUserScriptTail[] = "\n})(window);";
 
 // Sets up the chrome.extension module. This may be run multiple times per
@@ skipping 14 matching lines @@
 
   int new_id = g_next_isolated_world_id;
   ++g_next_isolated_world_id;
 
   // This map will tend to pile up over time, but realistically, you're never
   // going to have enough extensions for it to matter.
   g_isolated_world_ids[extension_id] = new_id;
   return new_id;
 }
 
+void UserScriptSlave::InitializeIsolatedWorld(
+    WebFrame* frame,
+    int isolated_world_id,
+    const Extension* extension) const {
+  frame->setIsolatedWorldSecurityOrigin(
+      isolated_world_id,
+      WebSecurityOrigin::create(extension->url()));
+
+  // We always have access to the origin of the page that we're injecting in.
+  GURL frame_url = GURL(frame->url());
+  WebSecurityPolicy::addOriginAccessWhitelistEntry(

[Matt Perry, 2011/05/26 22:39:48]

note that we never clear the origin access whitelist. if an extension is
reloaded, existing renderer processes will have the old whitelists. this is a
minor point, so I think it's fine to add a TODO for now.

+      extension->url(),
+      WebString::fromUTF8(frame_url.scheme()),
+      WebString::fromUTF8(frame_url.host()),
+      false); // do not match subdomains
+
+  ExtensionDispatcher::InitHostPermissions(extension);
+}
+
 UserScriptSlave::UserScriptSlave(const ExtensionSet* extensions)
     : shared_memory_(NULL),
       script_deleter_(&scripts_),
       extensions_(extensions) {
   api_js_ = ResourceBundle::GetSharedInstance().GetRawDataResource(
                 IDR_GREASEMONKEY_API_JS);
 }
 
 UserScriptSlave::~UserScriptSlave() {}
 
@@ skipping 169 matching lines @@
       if (script->is_standalone() || script->emulate_greasemonkey()) {
         sources.insert(sources.begin(),
             WebScriptSource(WebString::fromUTF8(api_js_.as_string())));
       }
 
       // Setup chrome.self to contain an Extension object with the correct
       // ID.
       if (!script->extension_id().empty()) {
         InsertInitExtensionCode(&sources, script->extension_id());
         isolated_world_id = GetIsolatedWorldId(script->extension_id());
+        InitializeIsolatedWorld(frame, isolated_world_id, extension);
       }
 
       PerfTimer exec_timer;
       frame->executeScriptInIsolatedWorld(
           isolated_world_id, &sources.front(), sources.size(),
           EXTENSION_GROUP_CONTENT_SCRIPTS);
       UMA_HISTOGRAM_TIMES("Extensions.InjectScriptTime", exec_timer.Elapsed());
     }
   }
 
   // Log debug info.
   if (location == UserScript::DOCUMENT_START) {
     UMA_HISTOGRAM_COUNTS_100("Extensions.InjectStart_CssCount", num_css);
     UMA_HISTOGRAM_COUNTS_100("Extensions.InjectStart_ScriptCount", num_scripts);
     if (num_css || num_scripts)
       UMA_HISTOGRAM_TIMES("Extensions.InjectStart_Time", timer.Elapsed());
   } else if (location == UserScript::DOCUMENT_END) {
     UMA_HISTOGRAM_COUNTS_100("Extensions.InjectEnd_ScriptCount", num_scripts);
     if (num_scripts)
       UMA_HISTOGRAM_TIMES("Extensions.InjectEnd_Time", timer.Elapsed());
   } else if (location == UserScript::DOCUMENT_IDLE) {
     UMA_HISTOGRAM_COUNTS_100("Extensions.InjectIdle_ScriptCount", num_scripts);
     if (num_scripts)
       UMA_HISTOGRAM_TIMES("Extensions.InjectIdle_Time", timer.Elapsed());
   } else {
     NOTREACHED();
   }
 }