Add Access-Control-Allow-Origin: * header for extension resources specifically listed as web acce...

chrome/browser/extensions/extension_protocols.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/extension_protocols.h"
 
 #include <algorithm>
 
 #include "base/compiler_specific.h"
 #include "base/file_path.h"
@@ skipping 19 matching lines @@
 #include "net/http/http_response_info.h"
 #include "net/http/http_response_headers.h"
 #include "net/url_request/url_request_error_job.h"
 #include "net/url_request/url_request_file_job.h"
 #include "net/url_request/url_request_simple_job.h"
 #include "ui/base/resource/resource_bundle.h"
 
 namespace {
 
 net::HttpResponseHeaders* BuildHttpHeaders(
-    const std::string& content_security_policy) {
+    const std::string& content_security_policy, const bool send_cors_header) {

[Matt Perry, 2012/01/10 23:47:24]

nit: don't const-ify parameters that are POD types like bool.

[Cris Neckar, 2012/01/26 00:48:44]

Done.

   std::string raw_headers;
   raw_headers.append("HTTP/1.1 200 OK");
   if (!content_security_policy.empty()) {
     raw_headers.append(1, '\0');
     raw_headers.append("X-WebKit-CSP: ");
     raw_headers.append(content_security_policy);
   }
+
+  if (send_cors_header) {
+    raw_headers.append(1, '\0');

[Aaron Boodman, 2012/01/10 23:40:33]

What's this?

[Cris Neckar, 2012/01/26 00:48:44]

newline

[Aaron Boodman, 2012/01/27 22:36:46]

Oh.

+    raw_headers.append("Access-Control-Allow-Origin: *");
+  }
   raw_headers.append(2, '\0');
   return new net::HttpResponseHeaders(raw_headers);
 }
 
 class URLRequestResourceBundleJob : public net::URLRequestSimpleJob {
  public:
   URLRequestResourceBundleJob(
       net::URLRequest* request, const FilePath& filename, int resource_id,
-      const std::string& content_security_policy)
+      const std::string& content_security_policy, const bool send_cors_header)
       : net::URLRequestSimpleJob(request),
         filename_(filename),
         resource_id_(resource_id) {
-    response_info_.headers = BuildHttpHeaders(content_security_policy);
+    response_info_.headers = BuildHttpHeaders(content_security_policy,
+                                              send_cors_header);
   }
 
   // Overridden from URLRequestSimpleJob:
   virtual bool GetData(std::string* mime_type,
                        std::string* charset,
                        std::string* data) const OVERRIDE {
     const ResourceBundle& rb = ResourceBundle::GetSharedInstance();
     *data = rb.GetRawDataResource(resource_id_).as_string();
 
     // Requests should not block on the disk!  On Windows this goes to the
@@ skipping 27 matching lines @@
   // The resource bundle id to load.
   int resource_id_;
 
   net::HttpResponseInfo response_info_;
 };
 
 class URLRequestExtensionJob : public net::URLRequestFileJob {
  public:
   URLRequestExtensionJob(net::URLRequest* request,
                          const FilePath& filename,
-                         const std::string& content_security_policy)
+                         const std::string& content_security_policy,
+                         const bool send_cors_header)
     : net::URLRequestFileJob(request, filename) {
-    response_info_.headers = BuildHttpHeaders(content_security_policy);
+      response_info_.headers = BuildHttpHeaders(content_security_policy,
+                                                send_cors_header);
   }
 
   virtual void GetResponseInfo(net::HttpResponseInfo* info) OVERRIDE {
     *info = response_info_;
   }
 
   net::HttpResponseInfo response_info_;
 };
 
 bool ExtensionCanLoadInIncognito(const std::string& extension_id,
@@ skipping 90 matching lines @@
         extension_info_map_->disabled_extensions().GetByID(extension_id);
     if (URLIsForExtensionIcon(request->url(), disabled_extension))
       directory_path = disabled_extension->path();
     if (directory_path.value().empty()) {
       LOG(WARNING) << "Failed to GetPathForExtension: " << extension_id;
       return NULL;
     }
   }
 
   std::string content_security_policy;
-  if (extension)
+  bool send_cors_header = false;
+  if (extension) {
     content_security_policy = extension->content_security_policy();
+    if ((extension->manifest_version() >= 2 ||
+             extension->HasWebAccessibleResources()) &&
+        extension->IsResourceWebAccessible(request->url().path()))
+      send_cors_header = true;
+  }
 
   FilePath resources_path;
   if (PathService::Get(chrome::DIR_RESOURCES, &resources_path) &&
       directory_path.DirName() == resources_path) {
     FilePath relative_path = directory_path.BaseName().Append(
         extension_file_util::ExtensionURLToRelativeFilePath(request->url()));
 #if defined(OS_WIN)
     relative_path = relative_path.NormalizeWindowsPathSeparators();
 #endif
 
     // TODO(tc): Make a map of FilePath -> resource ids so we don't have to
     // covert to FilePaths all the time.  This will be more useful as we add
     // more resources.
     for (size_t i = 0; i < kComponentExtensionResourcesSize; ++i) {
       FilePath bm_resource_path =
           FilePath().AppendASCII(kComponentExtensionResources[i].name);
 #if defined(OS_WIN)
       bm_resource_path = bm_resource_path.NormalizeWindowsPathSeparators();
 #endif
       if (relative_path == bm_resource_path) {
         return new URLRequestResourceBundleJob(request, relative_path,
-            kComponentExtensionResources[i].value, content_security_policy);
+            kComponentExtensionResources[i].value, content_security_policy,
+            send_cors_header);
       }
     }
   }
   // TODO(tc): Move all of these files into resources.pak so we don't break
   // when updating on Linux.
   ExtensionResource resource(extension_id, directory_path,
       extension_file_util::ExtensionURLToRelativeFilePath(request->url()));
 
   FilePath resource_file_path;
   {
     // Getting the file path will touch the file system.  Fixing
     // crbug.com/59849 would also fix this.  Suppress the error for now.
     base::ThreadRestrictions::ScopedAllowIO allow_io;
     resource_file_path = resource.GetFilePath();
   }
 
   return new URLRequestExtensionJob(request, resource_file_path,
-                                    content_security_policy);
+                                    content_security_policy, send_cors_header);
 }
 
 }  // namespace
 
 net::URLRequestJobFactory::ProtocolHandler* CreateExtensionProtocolHandler(
     bool is_incognito,
     ExtensionInfoMap* extension_info_map) {
   return new ExtensionProtocolHandler(is_incognito, extension_info_map);
 }