Add 'web_accessible_resource" keyword for version 2 extension manifests. This makes extension res...

chrome/renderer/extensions/extension_resource_request_policy.cc

Index: chrome/renderer/extensions/extension_resource_request_policy.cc
===================================================================
--- chrome/renderer/extensions/extension_resource_request_policy.cc	(revision 113054)
+++ chrome/renderer/extensions/extension_resource_request_policy.cc	(working copy)
@@ -38,6 +38,22 @@
     return false;
   }
 
+  // Disallow loading of extension resources which are not explicitely listed
+  // as web accessible if the manifest version is 2 or greater.
+
+  // Exceptions are:
+  // - empty origin (needed for some edge cases when we have empty origins)
+  // - chrome-extension:// (for legacy reasons -- some extensions interop)
+  if (!frame_url.is_empty() &&
+      !frame_url.SchemeIs(chrome::kExtensionScheme) &&
+      (extension->manifest_version() >= 2 ||

[Aaron Boodman, 2011/12/09 15:17:22]

Why not move the manifest-version part of this into Extension, so that it can be
unit tested?

+           extension->HasWebAccessibleResources()) &&
+      !extension->IsResourceWebAccessible(resource_url.path())) {
+    LOG(ERROR) << "Denying load of " << resource_url.spec() << " which "
+               << "is not a web accessible resource.";
+    return false;
+  }
+
   return true;
 }