Fix for WebView accessible resources.

chrome/renderer/extensions/resource_request_policy.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/extensions/resource_request_policy.h"
 
 #include "base/logging.h"
 #include "base/strings/stringprintf.h"
 #include "chrome/common/extensions/chrome_manifest_url_handlers.h"
 #include "chrome/common/url_constants.h"
 #include "extensions/common/constants.h"
 #include "extensions/common/extension.h"
+#include "extensions/common/manifest_constants.h"
 #include "extensions/common/manifest_handlers/icons_handler.h"
 #include "extensions/common/manifest_handlers/web_accessible_resources_info.h"
+#include "extensions/common/manifest_handlers/webview_info.h"
 #include "extensions/renderer/renderer_extension_registry.h"
 #include "third_party/WebKit/public/platform/WebString.h"
 #include "third_party/WebKit/public/web/WebConsoleMessage.h"
 #include "third_party/WebKit/public/web/WebDocument.h"
 #include "third_party/WebKit/public/web/WebFrame.h"
 #include "ui/base/page_transition_types.h"
 #include "url/gurl.h"
 
 namespace extensions {
 
+namespace {
+
+base::LazyInstance<std::string> webview_partition_id =
+    LAZY_INSTANCE_INITIALIZER;

[not at google - send to devlin, 2015/08/31 18:31:44]

It would be better to make ResourceRequestPolicy a singleton (i.e. a
LazyInstance) with a Get() method, rather than making every method static then
having a LazyInstance for everything that happens to be stateful.

SetWebViewPartitionID would be a method on ResourceRequestPolicy.

[paulmeyer, 2015/08/31 21:40:08]

I'll leave this class alone since I won't be adding the partition ID in here
anymore.

+
+}  // namespace
+
+ResourceRequestPolicy::ResourceRequestPolicy() {}
+
 // This method does a security check whether chrome-extension:// URLs can be
 // requested by the renderer. Since this is in an untrusted process, the browser
 // has a similar check to enforce the policy, in case this process is exploited.
 // If you are changing this function, ensure equivalent checks are added to
 // extension_protocols.cc's AllowExtensionResourceLoad.
 
 // static
 bool ResourceRequestPolicy::CanRequestResource(
     const GURL& resource_url,
     blink::WebFrame* frame,
@@ skipping 17 matching lines @@
                                   : resource_url.path().substr(1);
   if (extension->is_hosted_app() &&
       !IconsInfo::GetIcons(extension)
           .ContainsPath(resource_root_relative_path)) {
     LOG(ERROR) << "Denying load of " << resource_url.spec() << " from "
                << "hosted app.";
     return false;
   }
 
   // Disallow loading of extension resources which are not explicitly listed
-  // as web accessible if the manifest version is 2 or greater.
+  // as web or WebView accessible if the manifest version is 2 or greater.
+  const WebviewInfo* webview_info = WebviewInfo::Get(extension);
   if (!WebAccessibleResourcesInfo::IsResourceWebAccessible(
-          extension, resource_url.path())) {
+          extension, resource_url.path()) &&
+      !(webview_info &&
+        webview_info->IsResourceWebviewAccessible(
+            extension, webview_partition_id.Get(), resource_url.path()))) {
     GURL frame_url = frame->document().url();
 
     // The page_origin may be GURL("null") for unique origins like data URLs,
     // but this is ok for the checks below.  We only care if it matches the
     // current extension or has a devtools scheme.
     GURL page_origin = GURL(frame->top()->securityOrigin().toString());
 
     // Exceptions are:
     // - empty origin (needed for some edge cases when we have empty origins)
     bool is_empty_origin = frame_url.is_empty();
@@ skipping 44 matching lines @@
       resource_url.spec().c_str());
     frame->addMessageToConsole(
         blink::WebConsoleMessage(blink::WebConsoleMessage::LevelError,
                                   blink::WebString::fromUTF8(message)));
     return false;
   }
 
   return true;
 }
 
-ResourceRequestPolicy::ResourceRequestPolicy() {
+// static
+void ResourceRequestPolicy::SetWebViewPartitionID(
+    const std::string& partition_id) {
+  // |webview_partition_id| cannot be changed once set.
+  std::string& stored_id = webview_partition_id.Get();
+  DCHECK(stored_id.empty() || stored_id == partition_id);
+  if (stored_id.empty())
+    stored_id = partition_id;
 }
 
 }  // namespace extensions