Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(4)

Unified Diff: extensions/browser/api/web_request/web_request_permissions.cc

Issue 1658913002: Make extensions use a correct same-origin check. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Respond to comments. Created 4 years, 11 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: extensions/browser/api/web_request/web_request_permissions.cc
diff --git a/extensions/browser/api/web_request/web_request_permissions.cc b/extensions/browser/api/web_request/web_request_permissions.cc
index fd73304e17ace4cc22c45edd7cf531d7f07b6589..ec0aa17446896930c653349a30c7722cd2be3d5f 100644
--- a/extensions/browser/api/web_request/web_request_permissions.cc
+++ b/extensions/browser/api/web_request/web_request_permissions.cc
@@ -15,6 +15,7 @@
#include "extensions/common/permissions/permissions_data.h"
#include "net/url_request/url_request.h"
#include "url/gurl.h"
+#include "url/origin.h"
using content::ResourceRequestInfo;
@@ -128,9 +129,9 @@ bool WebRequestPermissions::CanExtensionAccessURL(
case REQUIRE_HOST_PERMISSION:
// about: URLs are not covered in host permissions, but are allowed
// anyway.
- if (!((url.SchemeIs(url::kAboutScheme) ||
- extension->permissions_data()->HasHostPermission(url) ||
- url.GetOrigin() == extension->url()))) {
+ if (!url.SchemeIs(url::kAboutScheme) &&
+ !extension->permissions_data()->HasHostPermission(url) &&
+ !url::IsSameOriginWith(url, extension->url())) {
return false;
}
break;

Powered by Google App Engine
This is Rietveld 408576698