Consider the origin when computing extension permissions

chrome/renderer/extensions/chrome_v8_extension.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/extensions/chrome_v8_extension.h"
 
 #include "base/logging.h"
 #include "base/lazy_instance.h"
 #include "base/stringprintf.h"
 #include "base/string_util.h"
 #include "chrome/common/extensions/extension.h"
 #include "chrome/common/extensions/extension_set.h"
 #include "chrome/common/extensions/api/extension_api.h"
 #include "chrome/renderer/extensions/chrome_v8_context.h"
 #include "chrome/renderer/extensions/extension_dispatcher.h"
 #include "content/public/renderer/render_view.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebDocument.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebFrame.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebView.h"
 #include "ui/base/resource/resource_bundle.h"
 
 using extensions::ExtensionAPI;
+using WebKit::WebDocument;
 using WebKit::WebFrame;
 using WebKit::WebView;
 
 namespace {
 
 const char kChromeHidden[] = "chromeHidden";
 
 #ifndef NDEBUG
 const char kValidateCallbacks[] = "validateCallbacks";
 #endif
@@ skipping 69 matching lines @@
     return NULL;
   else
     return iter->second.get();
 }
 
 const Extension* ChromeV8Extension::GetExtensionForCurrentRenderView() const {
   content::RenderView* renderview = GetCurrentRenderView();
   if (!renderview)
     return NULL;  // this can happen as a tab is closing.
 
-  GURL url = renderview->GetWebView()->mainFrame()->document().url();
+  WebDocument document = renderview->GetWebView()->mainFrame()->document();
+  GURL url = document.url();
   const ExtensionSet* extensions = extension_dispatcher_->extensions();
-  if (!extensions->ExtensionBindingsAllowed(url))
+  if (!extensions->ExtensionBindingsAllowed(document.securityOrigin(), url))
     return NULL;
 
-  return extensions->GetByURL(url);
+  return extensions->GetByURL(document.securityOrigin(), url);
 }
 
 bool ChromeV8Extension::CheckCurrentContextAccessToExtensionAPI(
     const std::string& function_name) const {
   ChromeV8Context* context =
       extension_dispatcher_->v8_context_set().GetCurrent();
   if (!context) {
     DLOG(ERROR) << "Not in a v8::Context";
     return false;
   }
@@ skipping 99 matching lines @@
   if (args.Length() < 1)
     return v8::Undefined();
 
   std::vector<std::string> components;
   for (int i = 0; i < args.Length(); ++i)
     components.push_back(*v8::String::Utf8Value(args[i]->ToString()));
 
   LOG(ERROR) << JoinString(components, ',');
   return v8::Undefined();
 }