| Index: chrome/renderer/chrome_content_renderer_client.cc
|
| diff --git a/chrome/renderer/chrome_content_renderer_client.cc b/chrome/renderer/chrome_content_renderer_client.cc
|
| index b7814592f2b28dab52ffb6676546c2535c18f6f7..921ad37d596d48d417f3eda60f56ebe55724d270 100644
|
| --- a/chrome/renderer/chrome_content_renderer_client.cc
|
| +++ b/chrome/renderer/chrome_content_renderer_client.cc
|
| @@ -131,6 +131,7 @@ using WebKit::WebVector;
|
| namespace {
|
|
|
| const char kWebViewTagName[] = "WEBVIEW";
|
| +const char kAdViewTagName[] = "ADVIEW";
|
|
|
| // Explicitly register all extension ManifestHandlers needed to parse
|
| // fields used in the renderer.
|
| @@ -398,9 +399,16 @@ bool ChromeContentRendererClient::OverrideCreatePlugin(
|
| WebDocument document = frame->document();
|
| const Extension* extension =
|
| GetExtension(document.securityOrigin());
|
| - if (extension && extension->HasAPIPermission(
|
| - extensions::APIPermission::kWebView))
|
| - return false;
|
| + if (extension) {
|
| + const extensions::APIPermission::ID perms[] = {
|
| + extensions::APIPermission::kWebView,
|
| + extensions::APIPermission::kAdView
|
| + };
|
| + for (size_t i = 0; i < arraysize(perms); ++i) {
|
| + if (extension->HasAPIPermission(perms[i]))
|
| + return false;
|
| + }
|
| + }
|
| }
|
|
|
| ChromeViewHostMsg_GetPluginInfo_Output output;
|
| @@ -1115,22 +1123,23 @@ bool ChromeContentRendererClient::AllowBrowserPlugin(
|
| return true;
|
|
|
| // If this |BrowserPlugin| <object> in the |container| is not inside a
|
| - // <webview> shadowHost, we disable instantiating this plugin. This is to
|
| - // discourage and prevent developers from accidentally attaching <object>
|
| - // directly in apps.
|
| + // <webview>/<adview> shadowHost, we disable instantiating this plugin. This
|
| + // is to discourage and prevent developers from accidentally attaching
|
| + // <object> directly in apps.
|
| //
|
| // Note that this check below does *not* ensure any security, it is still
|
| // possible to bypass this check.
|
| // TODO(lazyboy): http://crbug.com/178663, Ensure we properly disallow
|
| - // instantiating BrowserPlugin outside of the <webview> shim.
|
| + // instantiating BrowserPlugin outside of the <webview>/<adview> shim.
|
| if (container->element().isNull())
|
| return false;
|
|
|
| if (container->element().shadowHost().isNull())
|
| return false;
|
|
|
| - return container->element().shadowHost().tagName().equals(
|
| - WebString::fromUTF8(kWebViewTagName));
|
| + WebString tag_name = container->element().shadowHost().tagName();
|
| + return tag_name.equals(WebString::fromUTF8(kWebViewTagName)) ||
|
| + tag_name.equals(WebString::fromUTF8(kAdViewTagName));
|
| }
|
|
|
| } // namespace chrome
|
|
|