Allow cross-origin XHR in unblessed extension context

chrome/renderer/extensions/dispatcher.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/extensions/dispatcher.h"
 
 #include "base/callback.h"
 #include "base/command_line.h"
 #include "base/debug/alias.h"
 #include "base/json/json_reader.h"
@@ skipping 511 matching lines @@
         base::TimeDelta::FromMilliseconds(kMaxExtensionIdleHandlerDelayMs),
         RenderThread::Get(), &RenderThread::IdleHandler);
   }
 
   // Initialize host permissions for any extensions that were activated before
   // WebKit was initialized.
   for (std::set<std::string>::iterator iter = active_extension_ids_.begin();
        iter != active_extension_ids_.end(); ++iter) {
     const Extension* extension = extensions_.GetByID(*iter);
     CHECK(extension);
-    InitOriginPermissions(extension);
   }
 
   EnableCustomElementWhiteList();
 
   is_webkit_initialized_ = true;
 }
 
 void Dispatcher::IdleNotification() {
   if (is_extension_process_) {
     // Dampen the forced delay as well if the extension stays idle for long
@@ skipping 583 matching lines @@
   Feature::Context context_type = ClassifyJavaScriptContext(
       extension,
       extension_group,
       UserScriptSlave::GetDataSourceURLForFrame(frame),
       frame->document().securityOrigin());
 
   ChromeV8Context* context =
       new ChromeV8Context(v8_context, frame, extension, context_type);
   v8_context_set_.Add(context);
 
+  if (extension)
+    InitOriginPermissions(extension, context_type);
+
   {
     scoped_ptr<ModuleSystem> module_system(new ModuleSystem(context,
                                                             &source_map_));
     context->set_module_system(module_system.Pass());
   }
   ModuleSystem* module_system = context->module_system();
 
   // Enable natives in startup.
   ModuleSystem::NativesEnabledScope natives_enabled_scope(
       module_system);
@@ skipping 188 matching lines @@
 
   active_extension_ids_.insert(extension_id);
 
   // This is called when starting a new extension page, so start the idle
   // handler ticking.
   RenderThread::Get()->ScheduleIdleHandler(kInitialExtensionIdleHandlerDelayMs);
 
   UpdateActiveExtensions();
 
   if (is_webkit_initialized_) {
-    InitOriginPermissions(extension);
     DOMActivityLogger::AttachToWorld(DOMActivityLogger::kMainWorldId,
                                      extension_id);
   }
 }
 
-void Dispatcher::InitOriginPermissions(const Extension* extension) {
+void Dispatcher::InitOriginPermissions(const Extension* extension,
+                                       Feature::Context context_type) {
   // TODO(jstritar): We should try to remove this special case. Also, these
   // whitelist entries need to be updated when the kManagement permission
   // changes.
-  if (extension->HasAPIPermission(APIPermission::kManagement)) {
+  if (context_type == Feature::BLESSED_EXTENSION_CONTEXT &&
+      extension->HasAPIPermission(APIPermission::kManagement)) {
     WebSecurityPolicy::addOriginAccessWhitelistEntry(
         extension->url(),
         WebString::fromUTF8(content::kChromeUIScheme),
         WebString::fromUTF8(chrome::kChromeUIExtensionIconHost),
         false);
   }
 
   AddOrRemoveOriginPermissions(
       UpdatedExtensionPermissionsInfo::ADDED,
       extension,
-      extension->GetActivePermissions()->explicit_hosts());
+      PermissionsData::GetEffectiveHostPermissions(extension));
 }
 
 void Dispatcher::AddOrRemoveOriginPermissions(
     UpdatedExtensionPermissionsInfo::Reason reason,
     const Extension* extension,
     const URLPatternSet& origins) {
   for (URLPatternSet::const_iterator i = origins.begin();
        i != origins.end(); ++i) {
     const char* schemes[] = {
       content::kHttpScheme,
@@ skipping 308 matching lines @@
 }
 
 void Dispatcher::ClearPortData(int port_id) {
   // Only the target port side has entries in |port_to_tab_id_map_|. If
   // |port_id| is a source port, std::map::erase() will just silently fail
   // here as a no-op.
   port_to_tab_id_map_.erase(port_id);
 }
 
 }  // namespace extensions