[Extensions] Use document url (not top url) for tab-specific permissions

extensions/renderer/extension_injection_host.cc

Index: extensions/renderer/extension_injection_host.cc
diff --git a/extensions/renderer/extension_injection_host.cc b/extensions/renderer/extension_injection_host.cc
index a97a7026a9c24b675855785eb78de1722b1e1509..3761964f699b0be2e43999f8aa521f52492843ec 100644
--- a/extensions/renderer/extension_injection_host.cc
+++ b/extensions/renderer/extension_injection_host.cc
@@ -2,9 +2,12 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "extensions/renderer/extension_injection_host.h"
+
+#include "content/public/renderer/render_frame.h"
 #include "extensions/common/extension_set.h"
 #include "extensions/common/manifest_handlers/csp_info.h"
-#include "extensions/renderer/extension_injection_host.h"
+#include "extensions/renderer/extension_frame_helper.h"
 
 namespace extensions {
 
@@ -42,7 +45,7 @@ const std::string& ExtensionInjectionHost::name() const {
 
 PermissionsData::AccessType ExtensionInjectionHost::CanExecuteOnFrame(
     const GURL& document_url,
-    const GURL& top_frame_url,
+    content::RenderFrame* render_frame,
     int tab_id,
     bool is_declarative) const {
   // If we don't have a tab id, we have no UI surface to ask for user consent.
@@ -50,6 +53,13 @@ PermissionsData::AccessType ExtensionInjectionHost::CanExecuteOnFrame(
   if (tab_id == -1)
     return PermissionsData::ACCESS_ALLOWED;
 
+  const std::string& extension_id =
+      ExtensionFrameHelper::Get(render_frame)->tab_extension_owner_id();
+  // We don't allow injections in any frame of an extension page (unless it's by
+  // the owning extension).
+  if (!extension_id.empty() && extension_id != extension_->id())
+    return PermissionsData::ACCESS_DENIED;
+
   // Declarative user scripts use "page access" (from "permissions" section in
   // manifest) whereas non-declarative user scripts use custom
   // "content script access" logic.
@@ -57,7 +67,6 @@ PermissionsData::AccessType ExtensionInjectionHost::CanExecuteOnFrame(
     return extension_->permissions_data()->GetPageAccess(
         extension_,
         document_url,
-        top_frame_url,
         tab_id,
         -1,  // no process id
         nullptr /* ignore error */);
@@ -65,7 +74,6 @@ PermissionsData::AccessType ExtensionInjectionHost::CanExecuteOnFrame(
     return extension_->permissions_data()->GetContentScriptAccess(
         extension_,
         document_url,
-        top_frame_url,
         tab_id,
         -1,  // no process id
         nullptr /* ignore error */);