Make extensions use a correct same-origin check.

extensions/browser/api/web_request/web_request_permissions.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/browser/api/web_request/web_request_permissions.h"
 
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "content/public/browser/resource_request_info.h"
 #include "extensions/browser/guest_view/web_view/web_view_renderer_state.h"
 #include "extensions/browser/info_map.h"
 #include "extensions/common/constants.h"
 #include "extensions/common/extension.h"
 #include "extensions/common/extension_urls.h"
 #include "extensions/common/permissions/permissions_data.h"
 #include "net/url_request/url_request.h"
 #include "url/gurl.h"
+#include "url/origin.h"
 
 using content::ResourceRequestInfo;
 
 namespace {
 
 // Returns true if the URL is sensitive and requests to this URL must not be
 // modified/canceled by extensions, e.g. because it is targeted to the webstore
 // to check for updates, extension blacklisting, etc.
 bool IsSensitiveURL(const GURL& url) {
   // TODO(battre) Merge this, CanExtensionAccessURL and
@@ skipping 93 matching lines @@
   // Check if this event crosses incognito boundaries when it shouldn't.
   if (crosses_incognito && !extension_info_map->CanCrossIncognito(extension))
     return false;
 
   switch (host_permissions_check) {
     case DO_NOT_CHECK_HOST:
       break;
     case REQUIRE_HOST_PERMISSION:
       // about: URLs are not covered in host permissions, but are allowed
       // anyway.
-      if (!((url.SchemeIs(url::kAboutScheme) ||
-             extension->permissions_data()->HasHostPermission(url) ||
-             url.GetOrigin() == extension->url()))) {
+      if (!url.SchemeIs(url::kAboutScheme) &&
+          !extension->permissions_data()->HasHostPermission(url) &&
+          !url::IsSameOriginWith(url, extension->url())) {
         return false;
       }
       break;
     case REQUIRE_ALL_URLS:
       if (!extension->permissions_data()->HasEffectiveAccessToAllHosts())
         return false;
       break;
   }
 
   return true;
 }