Make extensions use a correct same-origin check.

extensions/browser/api/web_request/web_request_permissions.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/browser/api/web_request/web_request_permissions.h"
 
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "content/public/browser/resource_request_info.h"
 #include "extensions/browser/guest_view/web_view/web_view_renderer_state.h"
 #include "extensions/browser/info_map.h"
 #include "extensions/common/constants.h"
 #include "extensions/common/extension.h"
 #include "extensions/common/extension_urls.h"
 #include "extensions/common/permissions/permissions_data.h"
 #include "net/url_request/url_request.h"
 #include "url/gurl.h"
+#include "url/origin.h"
 
 using content::ResourceRequestInfo;
 
 namespace {
 
 // Returns true if the URL is sensitive and requests to this URL must not be
 // modified/canceled by extensions, e.g. because it is targeted to the webstore
 // to check for updates, extension blacklisting, etc.
 bool IsSensitiveURL(const GURL& url) {
   // TODO(battre) Merge this, CanExtensionAccessURL and
@@ skipping 95 matching lines @@
     return false;
 
   switch (host_permissions_check) {
     case DO_NOT_CHECK_HOST:
       break;
     case REQUIRE_HOST_PERMISSION:
       // about: URLs are not covered in host permissions, but are allowed
       // anyway.
       if (!((url.SchemeIs(url::kAboutScheme) ||
              extension->permissions_data()->HasHostPermission(url) ||
-             url.GetOrigin() == extension->url()))) {
+             url::Origin(url).IsSameOriginWith(
+                 url::Origin(extension->url()))))) {

[meacer, 2016/02/02 01:35:08]

While you are at it, do you mind applying De Morgan's law here? This seems a bit
easier to reason about:

if (url.SchemeIs(url::kAboutScheme) &&
    !extension->permissions_data()->HasHostPermission(url) &&
    !url::Origin(url).IsSameOriginWith(url::Origin(extension->url()) {
  return false;
}

[palmer, 2016/02/02 23:12:38]

Good idea. But, it should be

    !url.SchemeIs(url::kAboutScheme)

, right?

[meacer, 2016/02/02 23:27:22]

Sure :)

         return false;
       }
       break;
     case REQUIRE_ALL_URLS:
       if (!extension->permissions_data()->HasEffectiveAccessToAllHosts())
         return false;
       break;
   }
 
   return true;
 }