Allow DOMUI pages to call window.open(), giving DOMUI privileges to the new

chrome/browser/tab_contents/tab_contents.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/tab_contents/tab_contents.h"
 
 #include "app/l10n_util.h"
 #include "app/resource_bundle.h"
 #include "base/file_version_info.h"
 #include "base/process_util.h"
@@ skipping 241 matching lines @@
       last_search_prepopulate_text_(NULL),
       last_search_result_(),
       capturing_contents_(false),
       is_being_destroyed_(false),
       notify_disconnection_(false),
       history_requests_(),
 #if defined(OS_WIN)
       message_box_active_(CreateEvent(NULL, TRUE, FALSE, NULL)),
 #endif
       last_javascript_message_dismissal_(),
-      suppress_javascript_messages_(false) {
+      suppress_javascript_messages_(false),
+      opener_dom_ui_type_(DOMUIFactory::kNoDOMUI) {
   pending_install_.page_id = 0;
   pending_install_.callback_functor = NULL;
 
 #if defined(OS_CHROMEOS)
   // Make sure the thumbnailer is started before starting the render manager.
   // The thumbnailer will want to listen for RVH creations, one of which will
   // happen in RVHManager::Init.
   ThumbnailGenerator* generator = g_browser_process->GetThumbnailGenerator();
   if (generator)
     generator->StartThumbnailing();
@@ skipping 992 matching lines @@
   if (controller_.pending_entry() &&
       (controller_.GetLastCommittedEntry() ||
        render_manager_.pending_dom_ui()))
     return render_manager_.pending_dom_ui();
   return render_manager_.dom_ui();
 }
 
 void TabContents::DidNavigateMainFramePostCommit(
     const NavigationController::LoadCommittedDetails& details,
     const ViewHostMsg_FrameNavigate_Params& params) {
+  if (opener_dom_ui_type_ != DOMUIFactory::kNoDOMUI) {
+    // If this is a window.open navigation, use the same DOMUI as the renderer
+    // that opened the window, as long as both renderers have the same
+    // privileges.
+    if (opener_dom_ui_type_ == DOMUIFactory::GetDOMUIType(GetURL())) {
+      DOMUI* dom_ui = DOMUIFactory::CreateDOMUIForURL(this, GetURL());
+      // dom_ui might be NULL if the URL refers to a non-existent extension.
+      if (dom_ui) {
+        render_manager_.SetDOMUIPostCommit(dom_ui);
+        dom_ui->RenderViewCreated(render_view_host());
+      }
+    }
+    opener_dom_ui_type_ = DOMUIFactory::kNoDOMUI;
+  }
+
   if (details.is_user_initiated_main_frame_load()) {
     // Clear the status bubble. This is a workaround for a bug where WebKit
     // doesn't let us know that the cursor left an element during a
     // transition (this is also why the mouse cursor remains as a hand after
     // clicking on a link); see bugs 1184641 and 980803. We don't want to
     // clear the bubble when a user navigates to a named anchor in the same
     // page.
     UpdateTargetURL(details.entry->page_id(), GURL());
 
     // UpdateHelpersForDidNavigate will handle the case where the password_form
@@ skipping 820 matching lines @@
 
 void TabContents::DomOperationResponse(const std::string& json_string,
                                        int automation_id) {
 }
 
 void TabContents::ProcessDOMUIMessage(const std::string& message,
                                       const std::string& content,
                                       int request_id,
                                       bool has_callback) {
   if (!render_manager_.dom_ui()) {
-    // We shouldn't get a DOM UI message when we haven't enabled the DOM UI.
-    // Because the renderer might be owned and sending random messages, we need
-    // to ignore these inproper ones.
-    NOTREACHED();
+    // This can happen if someone uses window.open() to open an extension URL
+    // from a non-extension context.
+    render_view_host()->BlockExtensionRequest(request_id);
     return;
   }
   render_manager_.dom_ui()->ProcessDOMUIMessage(message, content, request_id,
                                                 has_callback);
 }
 
 void TabContents::ProcessExternalHostMessage(const std::string& message,
                                              const std::string& origin,
                                              const std::string& target) {
   if (delegate())
@@ skipping 341 matching lines @@
 
     default:
       NOTREACHED();
   }
 }
 
 void TabContents::set_encoding(const std::wstring& encoding) {
   encoding_ = CharacterEncoding::GetCanonicalEncodingNameByAliasName(encoding);
 }