Add frameId to chrome.tabs.executeScript/insertCSS

extensions/renderer/programmatic_script_injector.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/renderer/programmatic_script_injector.h"
 
 #include <utility>
 #include <vector>
 
 #include "base/values.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/renderer/render_frame.h"
 #include "extensions/common/error_utils.h"
 #include "extensions/common/extension_messages.h"
 #include "extensions/common/manifest_constants.h"
+#include "extensions/common/permissions/api_permission.h"
 #include "extensions/common/permissions/permissions_data.h"
 #include "extensions/renderer/injection_host.h"
+#include "extensions/renderer/renderer_extension_registry.h"
 #include "extensions/renderer/script_context.h"
 #include "third_party/WebKit/public/platform/WebString.h"
 #include "third_party/WebKit/public/web/WebDocument.h"
 #include "third_party/WebKit/public/web/WebLocalFrame.h"
 #include "third_party/WebKit/public/web/WebScriptSource.h"
 
 namespace extensions {
 
 ProgrammaticScriptInjector::ProgrammaticScriptInjector(
     const ExtensionMsg_ExecuteCode_Params& params,
     content::RenderFrame* render_frame)
     : params_(new ExtensionMsg_ExecuteCode_Params(params)),
       url_(
           ScriptContext::GetDataSourceURLForFrame(render_frame->GetWebFrame())),
       finished_(false) {
-  effective_url_ = ScriptContext::GetEffectiveDocumentURL(
-      render_frame->GetWebFrame(), url_, params.match_about_blank);
+  if (url_.SchemeIs(url::kAboutScheme)) {
+    origin_for_about_error_ =
+        render_frame->GetWebFrame()->securityOrigin().toString().utf8();
+  }
 }
 
 ProgrammaticScriptInjector::~ProgrammaticScriptInjector() {
 }
 
 UserScript::InjectionType ProgrammaticScriptInjector::script_type()
     const {
   return UserScript::PROGRAMMATIC_SCRIPT;
 }
 
@@ skipping 77 matching lines @@
     results_.Append(std::move(execution_result));
   Finish(std::string(), render_frame);
 }
 
 void ProgrammaticScriptInjector::OnWillNotInject(
     InjectFailureReason reason,
     content::RenderFrame* render_frame) {
   std::string error;
   switch (reason) {
     case NOT_ALLOWED:
-      if (url_.SchemeIs(url::kAboutScheme)) {
+      if (!CanShowUrlInError()) {
+        error = manifest_errors::kCannotAccessPage;
+      } else if (!origin_for_about_error_.empty()) {
         error = ErrorUtils::FormatErrorMessage(
             manifest_errors::kCannotAccessAboutUrl, url_.spec(),
-            effective_url_.GetOrigin().spec());
+            origin_for_about_error_);
       } else {
-        // TODO(?) It would be nice to show kCannotAccessPageWithUrl here if
-        // this is triggered by an extension with tabs permission. See
-        // https://codereview.chromium.org/1414223005/diff/1/extensions/
-        // common/manifest_constants.cc#newcode269
-        error = manifest_errors::kCannotAccessPage;
+        error = ErrorUtils::FormatErrorMessage(
+            manifest_errors::kCannotAccessPageWithUrl, url_.spec());
       }
       break;
     case EXTENSION_REMOVED:  // no special error here.
     case WONT_INJECT:
       break;
   }
   Finish(error, render_frame);
 }
 
+bool ProgrammaticScriptInjector::CanShowUrlInError() const {
+  if (params_->host_id.type() != HostID::EXTENSIONS)
+    return false;
+  const Extension* extension =
+      RendererExtensionRegistry::Get()->GetByID(params_->host_id.id());
+  if (!extension)
+    return false;
+  return extension->permissions_data()->active_permissions().HasAPIPermission(

[Devlin, 2016/01/25 19:36:40]

It might be worth a note that we don't need to account for activeTab here
because if the extension has activeTab, it wouldn't have been rejected.

[robwu, 2016/01/26 11:03:02]

Even with activeTab, one does not get access to restricted URLs such as
chrome://. Should I add a check for activeTab as well?

[Devlin, 2016/01/26 20:40:36]

Nah - activeTab shouldn't really grant any access to chrome:// urls, so this is
okay.

[robwu, 2016/01/26 23:57:58]

Acknowledged.

+      APIPermission::kTab);
+}
+
 UserScript::RunLocation ProgrammaticScriptInjector::GetRunLocation() const {
   return static_cast<UserScript::RunLocation>(params_->run_at);
 }
 
 void ProgrammaticScriptInjector::Finish(const std::string& error,
                                         content::RenderFrame* render_frame) {
   DCHECK(!finished_);
   finished_ = true;
 
   // It's possible that the render frame was destroyed in the course of
   // injecting scripts. Don't respond if it was (the browser side watches for
   // frame deletions so nothing is left hanging).
   if (render_frame) {
     render_frame->Send(
         new ExtensionHostMsg_ExecuteCodeFinished(
             render_frame->GetRoutingID(), params_->request_id,
             error, url_, results_));
   }
 }
 
 }  // namespace extensions