Hide requests in an extension from other extensions

extensions/browser/api/web_request/web_request_api.cc

Index: extensions/browser/api/web_request/web_request_api.cc
diff --git a/extensions/browser/api/web_request/web_request_api.cc b/extensions/browser/api/web_request/web_request_api.cc
index 801e58dfe539abb0035c42ec723b76cb05d80043..13724972de400fecc8d3273f7c10437ed1b88f95 100644
--- a/extensions/browser/api/web_request/web_request_api.cc
+++ b/extensions/browser/api/web_request/web_request_api.cc
@@ -416,7 +416,7 @@ void WebRequestAPI::OnListenerRemoved(const EventListenerInfo& details) {
                                      details.browser_context,
                                      details.extension_id,
                                      details.event_name,
-                                     0 /* embedder_process_id */,
+                                     0 /* embedder_process_id (ignored) */,
                                      0 /* web_view_instance_id */));
 }
 
@@ -445,12 +445,20 @@ struct ExtensionWebRequestEventRouter::EventListener {
     if (sub_event_name != that.sub_event_name)
       return sub_event_name < that.sub_event_name;
 
-    if (embedder_process_id != that.embedder_process_id)
-      return embedder_process_id < that.embedder_process_id;
-
     if (web_view_instance_id != that.web_view_instance_id)
       return web_view_instance_id < that.web_view_instance_id;
 
+    if (web_view_instance_id == 0) {
+      // For non-webviews, ignore the process ID because the extension id and
+      // subevent name already identifies a listener. This allows for the use
+      // of find() without specifying the process ID of the extension.
+      DCHECK(embedder_process_id == 0 || that.embedder_process_id == 0);
+      return false;
+    }
+
+    if (embedder_process_id != that.embedder_process_id)
+      return embedder_process_id < that.embedder_process_id;
+
     return false;
   }
 
@@ -1238,6 +1246,8 @@ void ExtensionWebRequestEventRouter::OnEventHandled(
     const std::string& sub_event_name,
     uint64 request_id,
     EventResponse* response) {
+  // TODO(robwu): Does this also work with webviews? operator< (used by find)
+  // takes the webview ID into account, which is not set on |listener|.
   EventListener listener;
   listener.extension_id = extension_id;
   listener.sub_event_name = sub_event_name;
@@ -1470,6 +1480,12 @@ void ExtensionWebRequestEventRouter::GetMatchingListenersImpl(
          it->web_view_instance_id != web_view_info.instance_id))
       continue;
 
+    // Filter requests from other extensions / apps. This does not work for
+    // content scripts, or extension pages in non-extension processes.
+    if (is_request_from_extension &&
+        it->embedder_process_id != render_process_host_id)
+      continue;
+
     if (!it->filter.urls.is_empty() && !it->filter.urls.MatchesURL(url))
       continue;
     if (web_request_event_router_delegate_ &&
@@ -2190,9 +2206,7 @@ bool WebRequestInternalAddEventListenerFunction::RunSync() {
   EXTENSION_FUNCTION_VALIDATE(args_->GetInteger(5, &web_view_instance_id));
 
   base::WeakPtr<IOThreadExtensionMessageFilter> ipc_sender = ipc_sender_weak();
-  int embedder_process_id =
-      ipc_sender.get() && web_view_instance_id > 0 ?
-          ipc_sender->render_process_id() : 0;
+  int embedder_process_id = ipc_sender ? ipc_sender->render_process_id() : 0;
 
   const Extension* extension =
       extension_info_map()->extensions().GetByID(extension_id_safe());