Fix extension bindings injection for iframes

chrome/browser/extensions/extension_bindings_apitest.cc

Index: chrome/browser/extensions/extension_bindings_apitest.cc
diff --git a/chrome/browser/extensions/extension_bindings_apitest.cc b/chrome/browser/extensions/extension_bindings_apitest.cc
index 387576f78c9594f291a0b3d98392fb7d0088d19d..ecf35a0eb5157e590f2240a3c55832183adc4848 100644
--- a/chrome/browser/extensions/extension_bindings_apitest.cc
+++ b/chrome/browser/extensions/extension_bindings_apitest.cc
@@ -208,5 +208,59 @@ IN_PROC_BROWSER_TEST_F(ExtensionBindingsApiTest,
   EXPECT_EQ("success", result);
 }
 
+// This tests that web pages with iframes pointing at chrome-extenison:// urls
+// don't get improper extensions bindings injected while they briefly still
+// point at about:blank and are still scriptable by their parent.
+//
+// The general idea is to load up 2 extensions, one which listens for external
+// messages ("receiver") and one which we'll try first faking a message from in
+// the web page's iframe, as well as actually send a message from later
+// ("sender").
+IN_PROC_BROWSER_TEST_F(ExtensionBindingsApiTest, IframeBeforeNavigate) {
+  // Load the sender and receiver extensions, and make sure they are ready.
+  ExtensionTestMessageListener sender_ready("sender_ready", true);
+  const Extension* sender = LoadExtension(
+      test_data_dir_.AppendASCII("bindings").AppendASCII("message_sender"));
+  ASSERT_NE(nullptr, sender);
+  sender_ready.set_extension_id(sender->id());
+  ASSERT_TRUE(sender_ready.WaitUntilSatisfied());
+
+  ExtensionTestMessageListener receiver_ready("receiver_ready", false);
+  const Extension* receiver =
+      LoadExtension(test_data_dir_.AppendASCII("bindings")
+                        .AppendASCII("external_message_listener"));
+  ASSERT_NE(nullptr, receiver);
+  receiver_ready.set_extension_id(receiver->id());
+  ASSERT_TRUE(receiver_ready.WaitUntilSatisfied());
+
+  // Load the web page which tries to impersonate the sender extension via
+  // scripting it's iframe before it finishes navigating to a web_accessible
+  // page in the sender.
+  ASSERT_TRUE(embedded_test_server()->Start());
+  ui_test_utils::NavigateToURL(
+      browser(),
+      embedded_test_server()->GetURL(
+          "/extensions/api_test/bindings/iframe_before_navigate.html"));
+
+  bool page_success = false;
+  ASSERT_TRUE(content::ExecuteScriptAndExtractBool(
+      browser()->tab_strip_model()->GetActiveWebContents(), "getResult()",
+      &page_success));
+  ASSERT_TRUE(page_success);
+
+  ExtensionTestMessageListener receiver_count(false);
+  receiver_count.set_extension_id(receiver->id());
+
+  // This should cause |sender| to send a real message over to |receiver|, at
+  // which point |receiver| will call test.sendMessage to send over the total
+  // count of messages it got.
+  sender_ready.Reply(receiver->id());
+  ASSERT_TRUE(receiver_count.WaitUntilSatisfied());
+
+  // If the code is correct, |receiver| will not have received an impersonated
+  // messages sent by iframe_before_navigate.html, so the result should be 1.
+  EXPECT_EQ("1", receiver_count.message());
+}
+
 }  // namespace
 }  // namespace extensions