extension: Checks the security token of the V8 context at GetModuleSystem().

extensions/renderer/v8_context_native_handler.cc

Index: extensions/renderer/v8_context_native_handler.cc
diff --git a/extensions/renderer/v8_context_native_handler.cc b/extensions/renderer/v8_context_native_handler.cc
index ed915cc423f717a1a5fb6ce04b96947e613db787..086bc4fd2fa23da3ebd0d47ab1544bf508155020 100644
--- a/extensions/renderer/v8_context_native_handler.cc
+++ b/extensions/renderer/v8_context_native_handler.cc
@@ -14,7 +14,6 @@ namespace extensions {
 V8ContextNativeHandler::V8ContextNativeHandler(ScriptContext* context,
                                                Dispatcher* dispatcher)
     : ObjectBackedNativeHandler(context),
-      context_(context),
       dispatcher_(dispatcher) {
   RouteFunction("GetAvailability",
                 base::Bind(&V8ContextNativeHandler::GetAvailability,
@@ -33,7 +32,7 @@ void V8ContextNativeHandler::GetAvailability(
   CHECK_EQ(args.Length(), 1);
   v8::Isolate* isolate = args.GetIsolate();
   std::string api_name = *v8::String::Utf8Value(args[0]);
-  Feature::Availability availability = context_->GetAvailability(api_name);
+  Feature::Availability availability = context()->GetAvailability(api_name);
 
   v8::Local<v8::Object> ret = v8::Object::New(isolate);
   ret->Set(v8::String::NewFromUtf8(isolate, "is_available"),
@@ -51,6 +50,10 @@ void V8ContextNativeHandler::GetModuleSystem(
   CHECK(args[0]->IsObject());
   v8::Local<v8::Context> v8_context =
       v8::Local<v8::Object>::Cast(args[0])->CreationContext();
+  // Returns undefined if it's a cross-domain access.
+  if (v8_context->GetSecurityToken() !=
+      args.GetIsolate()->GetCurrentContext()->GetSecurityToken())

[jochen (gone - plz use gerrit), 2015/07/13 12:01:17]

i'd rather not duplicate the security check logic, but use the one from
BindingSecurity

+    return;
   ScriptContext* context =
       dispatcher_->script_context_set().GetByV8Context(v8_context);
   args.GetReturnValue().Set(context->module_system()->NewInstance());