Consider the origin when computing extension permissions

chrome/common/extensions/extension_set.h

Index: chrome/common/extensions/extension_set.h
===================================================================
--- chrome/common/extensions/extension_set.h	(revision 111763)
+++ chrome/common/extensions/extension_set.h	(working copy)
@@ -14,6 +14,7 @@
 #include "base/memory/ref_counted.h"
 #include "chrome/common/extensions/extension.h"
 #include "googleurl/src/gurl.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebSecurityOrigin.h"
 
 // The one true extension container. Extensions are identified by their id.
 // Only one extension can be in the set with a given ID.
@@ -45,15 +46,19 @@
 
   // Returns the extension ID that the given URL is a part of, or empty if
   // none. This includes web URLs that are part of an extension's web extent.
-  std::string GetIdByURL(const GURL& url) const;
+  std::string GetIdByURL(WebKit::WebSecurityOrigin origin,

[Aaron Boodman, 2011/11/30 02:01:31]

What about defining an ExtensionURLInfo struct or something to encapsulate this
weirdness? That would also provide a convenient place to explain why we need it.

[Aaron Boodman, 2011/11/30 02:04:45]

And would at least ensure people think twice when looking up extensions by URL.

[abarth-chromium, 2011/11/30 02:04:49]

Will do.

+                        const GURL& url) const;
 
   // Returns the Extension that the given URL is a part of, or NULL if none.
   // This includes web URLs that are part of an extension's web extent.
   // NOTE: This can return NULL if called before UpdateExtensions receives
   // bulk extension data (e.g. if called from
   // EventBindings::HandleContextCreated)
-  const Extension* GetByURL(const GURL& url) const;
+  const Extension* GetByURL(WebKit::WebSecurityOrigin origin,
+                            const GURL& url) const;
 
+  const Extension* GetByURLWithoutSecurityCheck(const GURL& url) const;

[Aaron Boodman, 2011/11/30 02:01:31]

ExtensionURLInfo could have a constructor that just takes a URL and has a
warning.

+
   // Returns true if |new_url| is in the extent of the same extension as
   // |old_url|.  Also returns true if neither URL is in an app.
   bool InSameExtent(const GURL& old_url, const GURL& new_url) const;
@@ -64,7 +69,8 @@
   // Returns true if |url| should get extension api bindings and be permitted
   // to make api calls. Note that this is independent of what extension
   // permissions the given extension has been granted.
-  bool ExtensionBindingsAllowed(const GURL& url) const;
+  bool ExtensionBindingsAllowed(WebKit::WebSecurityOrigin origin,
+                                const GURL& url) const;
 
  private:
   FRIEND_TEST_ALL_PREFIXES(ExtensionSetTest, ExtensionSet);