[Extensions] Don't allow extensions to inject scripts into extension pages

extensions/renderer/script_injection.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/renderer/script_injection.h"
 
 #include <map>
 
 #include "base/lazy_instance.h"
 #include "base/metrics/histogram.h"
 #include "base/timer/elapsed_timer.h"
 #include "base/values.h"
 #include "content/public/child/v8_value_converter.h"
 #include "content/public/renderer/render_frame.h"
 #include "extensions/common/extension_messages.h"
 #include "extensions/common/host_id.h"
 #include "extensions/renderer/dom_activity_logger.h"
+#include "extensions/renderer/extension_frame_helper.h"
 #include "extensions/renderer/extension_groups.h"
 #include "extensions/renderer/extensions_renderer_client.h"
 #include "extensions/renderer/script_injection_callback.h"
 #include "extensions/renderer/scripts_run_info.h"
 #include "third_party/WebKit/public/platform/WebString.h"
 #include "third_party/WebKit/public/web/WebDocument.h"
 #include "third_party/WebKit/public/web/WebLocalFrame.h"
 #include "third_party/WebKit/public/web/WebScriptSource.h"
 #include "third_party/WebKit/public/web/WebSecurityOrigin.h"
 #include "url/gurl.h"
@@ skipping 62 matching lines @@
 
 // static
 void ScriptInjection::RemoveIsolatedWorld(const std::string& host_id) {
   g_isolated_worlds.Get().erase(host_id);
 }
 
 ScriptInjection::ScriptInjection(
     scoped_ptr<ScriptInjector> injector,
     content::RenderFrame* render_frame,
     scoped_ptr<const InjectionHost> injection_host,
-    UserScript::RunLocation run_location,
-    int tab_id)
+    UserScript::RunLocation run_location)
     : injector_(injector.Pass()),
       render_frame_(render_frame),
       injection_host_(injection_host.Pass()),
       run_location_(run_location),
-      tab_id_(tab_id),
       request_id_(kInvalidRequestId),
       complete_(false),
       did_inject_js_(false),
       weak_ptr_factory_(this) {
   CHECK(injection_host_.get());
 }
 
 ScriptInjection::~ScriptInjection() {
   if (!complete_)
     injector_->OnWillNotInject(ScriptInjector::WONT_INJECT);
@@ skipping 11 matching lines @@
     return INJECTION_WAITING;
   }
 
   if (!injection_host_) {
     NotifyWillNotInject(ScriptInjector::EXTENSION_REMOVED);
     return INJECTION_FINISHED;  // We're done.
   }
 
   blink::WebLocalFrame* web_frame = render_frame_->GetWebFrame();
   switch (injector_->CanExecuteOnFrame(
-      injection_host_.get(), web_frame, tab_id_)) {
+      injection_host_.get(), web_frame,
+      ExtensionFrameHelper::Get(render_frame_)->tab_id())) {
     case PermissionsData::ACCESS_DENIED:
       NotifyWillNotInject(ScriptInjector::NOT_ALLOWED);
       return INJECTION_FINISHED;  // We're done.
     case PermissionsData::ACCESS_WITHHELD:
-      // Note: we don't consider ACCESS_WITHHELD for child frames because there
-      // is nowhere to surface a request for a child frame.
-      // TODO(devlin): We should ask for permission somehow. crbug.com/491402.
-      if (web_frame->parent()) {
-        NotifyWillNotInject(ScriptInjector::NOT_ALLOWED);
-        return INJECTION_FINISHED;
-      }
-
       SendInjectionMessage(true /* request permission */);
       return INJECTION_WAITING;  // Wait around for permission.
     case PermissionsData::ACCESS_ALLOWED:
       InjectionResult result = Inject(scripts_run_info);
       // If the injection is blocked, we need to set the manager so we can
       // notify it upon completion.
       if (result == INJECTION_BLOCKED)
         async_completion_callback_ = async_completion_callback;
       return result;
   }
@@ skipping 138 matching lines @@
 
 void ScriptInjection::InjectCss() {
   std::vector<std::string> css_sources =
       injector_->GetCssSources(run_location_);
   blink::WebLocalFrame* web_frame = render_frame_->GetWebFrame();
   for (const std::string& css : css_sources)
     web_frame->document().insertStyleSheet(blink::WebString::fromUTF8(css));
 }
 
 }  // namespace extensions