Add 'web_accessible_resource" keyword for version 2 extension manifests. This makes extension res...

chrome/renderer/extensions/extension_resource_request_policy.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/extensions/extension_resource_request_policy.h"
 
 #include "base/logging.h"
 #include "chrome/common/url_constants.h"
 #include "chrome/common/extensions/extension.h"
 #include "chrome/common/extensions/extension_set.h"
@@ skipping 20 matching lines @@
   // launchers.
   std::string resource_root_relative_path =
       resource_url.path().empty() ? "" : resource_url.path().substr(1);
   if (extension->is_hosted_app() &&
       !extension->icons().ContainsPath(resource_root_relative_path)) {
     LOG(ERROR) << "Denying load of " << resource_url.spec() << " from "
                << "hosted app.";
     return false;
   }
 
+  // Disallow loading of extension resources which are not explicitely listed
+  // as web accessible if the manifest version is 2 or greater.
+
+  // Exceptions are:
+  // - empty origin (needed for some edge cases when we have empty origins)

[abarth-chromium, 2011/12/08 23:52:45]

Empty origins no longer exist.

[Cris Neckar, 2011/12/09 00:06:22]

Extension background pages still do. This is what was causing all the unit test
failures.

+  // - chrome-extension:// (for legacy reasons -- some extensions interop)
+  // - data: (basic HTML notifications use data URLs internally)

[abarth-chromium, 2011/12/08 23:52:45]

Doesn't this cause a big security hole?  Any web site can use a frame with a
data URL to make a frame to a non-public extension resource.  It seems like we
need a better way to whitelist notifications.

[Cris Neckar, 2011/12/09 00:06:22]

Yeah good point. I included this because Aaron had it in the original version
which blocked resource loads from pages which the extension doesn't request
access to.

I'm not sure what the reasoning was. I can take it out and see if anything still
breaks. 

+  if (!frame_url.is_empty() &&
+      !frame_url.SchemeIs(chrome::kExtensionScheme) &&
+      !frame_url.SchemeIs(chrome::kDataScheme) &&
+      (extension->manifest_version() >= 2 ||
+           extension->HasWebAccessibleResources()) &&
+      !extension->IsResourceWebAccessible(resource_url.path())) {
+    LOG(ERROR) << "Denying load of " << resource_url.spec() << " which "
+               << "is not a web accessible resource.";
+    return false;
+  }
+
   return true;
 }
 
 ExtensionResourceRequestPolicy::ExtensionResourceRequestPolicy() {
 }