Allow cross-origin XHR in unblessed extension context

Allow cross-origin XHR in unblessed extension context

Allow non-sandboxed extension pages in a non-extension process to use cross-origin XHR when the extension has the correct permissions.

Removed duplicate XHR origin whitelisting logic. Now the XHR origin logic for content scripts is identical to the extension's.

Contributed by Rob Wu <rob@robwu.nl>;

BUG=302548
TEST=Follow the steps-to-reproduce in the linked bug.

Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=254951

[robwu, 2014-02-19 00:12:55]

This fix allows framed extensions pages to use XHR with the extensions host
permissions. It does not degrade security, because the feature was already
possible.

Cross-origin XHR is allowed iff WebSecurityPolicy:addOriginAccessWhitelistEntry
has been called for the (extension) URL.
This can trivially be achieved by inserting a content script in the tab (e.g. by
using a dummy URL like http://example.com/somethingunguessable). However, this
hack is inefficient, so, I'd rather fix the bug instead of promoting a hack.

[Matt Perry, 2014-02-19 01:56:15]

I've added a comment on the bug. Please take a look there.

[not at google - send to devlin, 2014-02-19 17:10:51]

https://codereview.chromium.org/169053005/diff/1/chrome/renderer/extensions/d...
File chrome/renderer/extensions/dispatcher.cc (right):

https://codereview.chromium.org/169053005/diff/1/chrome/renderer/extensions/d...
chrome/renderer/extensions/dispatcher.cc:1141: }
if you extend this to all extension contexts (i.e. make the condition "if
extension") then the other origin permission granting mechanisms should be
unnecessary, including the one in user script slave.

[robwu, 2014-02-19 18:06:14]

On 2014/02/19 17:10:51, kalman wrote:
>
https://codereview.chromium.org/169053005/diff/1/chrome/renderer/extensions/d...
> File chrome/renderer/extensions/dispatcher.cc (right):
> 
>
https://codereview.chromium.org/169053005/diff/1/chrome/renderer/extensions/d...
> chrome/renderer/extensions/dispatcher.cc:1141: }
> if you extend this to all extension contexts (i.e. make the condition "if
> extension") then the other origin permission granting mechanisms should be
> unnecessary, including the one in user script slave.

Done. 
I've checked the code paths and verified that the refactor does not break the
existing functionality, i.e. the origins are still whitelisted in time
(http://pastebin.com/GdZswsCk).

[not at google - send to devlin, 2014-02-19 18:28:20]

https://codereview.chromium.org/169053005/diff/60001/chrome/renderer/extensio...
File chrome/renderer/extensions/dispatcher.cc (right):

https://codereview.chromium.org/169053005/diff/60001/chrome/renderer/extensio...
chrome/renderer/extensions/dispatcher.cc:1136: if (context_type ==
Feature::CONTENT_SCRIPT_CONTEXT ||
did "if (extension)" not work (and allow you to delete the corresponding check
in ActivateExtension)?

[robwu, 2014-02-19 21:34:27]

On 2014/02/19 18:28:20, kalman wrote:
>
https://codereview.chromium.org/169053005/diff/60001/chrome/renderer/extensio...
> File chrome/renderer/extensions/dispatcher.cc (right):
> 
>
https://codereview.chromium.org/169053005/diff/60001/chrome/renderer/extensio...
> chrome/renderer/extensions/dispatcher.cc:1136: if (context_type ==
> Feature::CONTENT_SCRIPT_CONTEXT ||
> did "if (extension)" not work (and allow you to delete the corresponding check
> in ActivateExtension)?

Done. From now on, content scripts, extension pages and unblessed extension
pages all share the same origin whitelisting code.

[robwu, 2014-03-02 15:02:40]

Ping @kalman

[not at google - send to devlin, 2014-03-03 19:57:48]

lgtm

https://codereview.chromium.org/169053005/diff/160001/chrome/renderer/extensi...
File chrome/renderer/extensions/dispatcher.cc (right):

https://codereview.chromium.org/169053005/diff/160001/chrome/renderer/extensi...
chrome/renderer/extensions/dispatcher.cc:1137: }
nit: no curlies.

[robwu, 2014-03-04 09:53:39]

The CQ bit was checked by rob@robwu.nl

[commit-bot: I haz the power, 2014-03-04 10:09:13]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/rob@robwu.nl/169053005/200001

[commit-bot: I haz the power, 2014-03-04 17:57:48]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2014-03-04 17:57:49]

The commit queue went berserk retrying too often for a
seemingly flaky test on builder android_dbg:
http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=android_db...
http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=android_db...
http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=android_db...
http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=android_db...
http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=android_db...

[robwu, 2014-03-04 23:39:54]

The CQ bit was checked by rob@robwu.nl

[commit-bot: I haz the power, 2014-03-04 23:40:44]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/rob@robwu.nl/169053005/200001

[commit-bot: I haz the power, 2014-03-05 01:19:24]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/rob@robwu.nl/169053005/200001

[commit-bot: I haz the power, 2014-03-05 06:03:45]

Change committed as 254951