Implement granular cross-origin XHR for extensions.

chrome/renderer/render_view.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/render_view.h"
 
 #include <algorithm>
 #include <string>
 #include <vector>
 
@@ skipping 1548 matching lines @@
     dom_ui_bindings_.BindToJavascript(frame, L"chrome");
   }
   if (BindingsPolicy::is_external_host_enabled(enabled_bindings_)) {
     external_host_bindings_.set_message_sender(this);
     external_host_bindings_.set_routing_id(routing_id_);
     external_host_bindings_.BindToJavascript(frame, L"externalHost");
   }
 }
 
 void RenderView::DocumentElementAvailable(WebFrame* frame) {
-  // TODO(mpcomplete): remove this before Chrome extensions ship.
-  // HACK.  This is a temporary workaround to allow cross-origin XHR for Chrome
-  // extensions.  It grants full access to every origin, when we really want
-  // to be able to restrict them more specifically.
+  // TODO(aa): Remove this before dev release.
   GURL url = frame->url();
   if (url.SchemeIs(chrome::kExtensionScheme))
     frame->grantUniversalAccess();
 
   if (RenderThread::current())  // Will be NULL during unit tests.
     RenderThread::current()->user_script_slave()->InjectScripts(
         frame, UserScript::DOCUMENT_START);
 
   // Notify the browser about non-blank documents loading in the top frame.
   if (url.is_valid() && url.spec() != "about:blank") {
@@ skipping 1739 matching lines @@
     Send(new ViewHostMsg_PasswordFormsSeen(routing_id_, password_forms));
 }
 
 void RenderView::Print(WebFrame* frame, bool script_initiated) {
   DCHECK(frame);
   if (print_helper_.get() == NULL) {
     print_helper_.reset(new PrintWebViewHelper(this));
   }
   print_helper_->Print(frame, script_initiated);
 }