Allow content script insertion on about:-URLs.

extensions/renderer/script_context.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/renderer/script_context.h"
 
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/strings/string_split.h"
 #include "base/values.h"
+#include "content/public/common/url_constants.h"
 #include "content/public/renderer/render_view.h"
 #include "content/public/renderer/v8_value_converter.h"
 #include "extensions/common/extension.h"
 #include "extensions/common/extension_api.h"
 #include "extensions/common/extension_urls.h"
 #include "extensions/common/features/base_feature_provider.h"
 #include "third_party/WebKit/public/web/WebDataSource.h"
+#include "third_party/WebKit/public/web/WebDocument.h"
 #include "third_party/WebKit/public/web/WebFrame.h"
 #include "third_party/WebKit/public/web/WebScopedMicrotaskSuppression.h"
+#include "third_party/WebKit/public/web/WebSecurityOrigin.h"
 #include "third_party/WebKit/public/web/WebView.h"
 #include "v8/include/v8.h"
 
 using content::V8ValueConverter;
 
 namespace extensions {
 
 ScriptContext::ScriptContext(const v8::Handle<v8::Context>& v8_context,
                              blink::WebFrame* web_frame,
                              const Extension* extension,
@@ skipping 125 matching lines @@
   // changes to match the parent document after Gmail document.writes into
   // it to create the editor.
   // http://code.google.com/p/chromium/issues/detail?id=86742
   blink::WebDataSource* data_source = frame->provisionalDataSource()
                                           ? frame->provisionalDataSource()
                                           : frame->dataSource();
   CHECK(data_source);
   return GURL(data_source->request().url());
 }
 
+// static
+GURL ScriptContext::GetEffectiveDocumentURL(const blink::WebFrame* frame,
+                                            const GURL& document_url,
+                                            bool match_about_blank) {
+  // Common scenario. If |match_about_blank| is false (as is the case in most
+  // extensions), or if the frame is not an about:-page, just return
+  // |document_url| (supposedly the URL of the frame).
+  if (!match_about_blank || !document_url.SchemeIs(content::kAboutScheme))
+    return document_url;
+
+  // Non-sandboxed about:blank and about:srcdoc pages inherit their security
+  // origin from their parent frame/window. So, traverse the frame/window
+  // hierarchy to find the closest non-about:-page and return its URL.
+  const blink::WebFrame* parent = frame;
+  do {
+    parent = parent->parent() ? parent->parent() : parent->opener();
+  } while (parent != NULL &&
+           GURL(parent->document().url()).SchemeIs(content::kAboutScheme));
+
+  if (parent) {
+    // Only return the parent URL if the frame can access it.
+    const blink::WebDocument& parent_document = parent->document();
+    if (frame->document().securityOrigin().canAccess(
+            parent_document.securityOrigin()))
+      return parent_document.url();
+  }
+  return document_url;
+}
+
 ScriptContext* ScriptContext::GetContext() { return this; }
 
 void ScriptContext::OnResponseReceived(const std::string& name,
                                        int request_id,
                                        bool success,
                                        const base::ListValue& response,
                                        const std::string& error) {
   v8::HandleScope handle_scope(isolate());
 
   scoped_ptr<V8ValueConverter> converter(V8ValueConverter::create());
   v8::Handle<v8::Value> argv[] = {
       v8::Integer::New(isolate(), request_id),
       v8::String::NewFromUtf8(isolate(), name.c_str()),
       v8::Boolean::New(isolate(), success),
       converter->ToV8Value(&response, v8_context_.NewHandle(isolate())),
       v8::String::NewFromUtf8(isolate(), error.c_str())};
 
   v8::Handle<v8::Value> retval = module_system()->CallModuleMethod(
       "sendRequest", "handleResponse", arraysize(argv), argv);
 
   // In debug, the js will validate the callback parameters and return a
   // string if a validation error has occured.
   DCHECK(retval.IsEmpty() || retval->IsUndefined())
       << *v8::String::Utf8Value(retval);
 }
 
 }  // namespace extensions