[Extensions] Don't allow extensions to inject scripts into extension pages

extensions/renderer/extension_injection_host.cc

Index: extensions/renderer/extension_injection_host.cc
diff --git a/extensions/renderer/extension_injection_host.cc b/extensions/renderer/extension_injection_host.cc
index 1a6dca87f2500313109499894c80adf7ffef8315..9a5e2037b6d541b74c229e661228ca7317b12855 100644
--- a/extensions/renderer/extension_injection_host.cc
+++ b/extensions/renderer/extension_injection_host.cc
@@ -50,11 +50,6 @@ PermissionsData::AccessType ExtensionInjectionHost::CanExecuteOnFrame(
     content::RenderFrame* render_frame,
     int tab_id,
     bool is_declarative) const {
-  // If we don't have a tab id, we have no UI surface to ask for user consent.
-  // For now, we treat this as an automatic allow.
-  if (tab_id == -1)
-    return PermissionsData::ACCESS_ALLOWED;
-
   blink::WebSecurityOrigin top_frame_security_origin =
       render_frame->GetWebFrame()->top()->securityOrigin();
   // Only whitelisted extensions may run scripts on another extension's page.
@@ -66,21 +61,30 @@ PermissionsData::AccessType ExtensionInjectionHost::CanExecuteOnFrame(
   // Declarative user scripts use "page access" (from "permissions" section in
   // manifest) whereas non-declarative user scripts use custom
   // "content script access" logic.
+  PermissionsData::AccessType access = PermissionsData::ACCESS_ALLOWED;
   if (is_declarative) {
-    return extension_->permissions_data()->GetPageAccess(
+    access = extension_->permissions_data()->GetPageAccess(
         extension_,
         document_url,
         tab_id,
         -1,  // no process id
         nullptr /* ignore error */);
   } else {
-    return extension_->permissions_data()->GetContentScriptAccess(
+    access = extension_->permissions_data()->GetContentScriptAccess(
         extension_,
         document_url,
         tab_id,
         -1,  // no process id
         nullptr /* ignore error */);
   }
+  if (access == PermissionsData::ACCESS_WITHHELD &&
+      (tab_id == -1 || render_frame->GetWebFrame()->parent())) {
+    // Note: we don't consider ACCESS_WITHHELD for child frames or for frames
+    // outside of tabs because there is nowhere to surface a request.
+    // TODO(devlin): We should ask for permission somehow. crbug.com/491402.
+    access = PermissionsData::ACCESS_DENIED;
+  }
+  return access;
 }
 
 bool ExtensionInjectionHost::ShouldNotifyBrowserOfInjection() const {