<webview>: Implement support for package-local chrome-extension:// URLs

chrome/browser/extensions/extension_protocols.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/extension_protocols.h"
 
 #include <algorithm>
 
 #include "base/base64.h"
 #include "base/compiler_specific.h"
 #include "base/file_util.h"
 #include "base/files/file_path.h"
 #include "base/format_macros.h"
 #include "base/logging.h"
 #include "base/memory/weak_ptr.h"
 #include "base/message_loop/message_loop.h"
 #include "base/path_service.h"
 #include "base/sha1.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/threading/sequenced_worker_pool.h"
 #include "base/threading/thread_restrictions.h"
 #include "build/build_config.h"
 #include "chrome/browser/extensions/extension_info_map.h"
+#include "chrome/browser/extensions/extension_renderer_state.h"
 #include "chrome/browser/extensions/image_loader.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/extensions/background_info.h"
 #include "chrome/common/extensions/csp_handler.h"
 #include "chrome/common/extensions/extension.h"
 #include "chrome/common/extensions/extension_file_util.h"
 #include "chrome/common/extensions/incognito_handler.h"
 #include "chrome/common/extensions/manifest_handlers/icons_handler.h"
 #include "chrome/common/extensions/manifest_handlers/shared_module_info.h"
 #include "chrome/common/extensions/manifest_url_handler.h"
 #include "chrome/common/extensions/web_accessible_resources_handler.h"
+#include "chrome/common/extensions/webview_handler.h"
 #include "chrome/common/url_constants.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/resource_request_info.h"
 #include "extensions/common/constants.h"
 #include "extensions/common/extension_resource.h"
 #include "grit/component_extension_resources_map.h"
 #include "net/base/mime_util.h"
 #include "net/base/net_errors.h"
 #include "net/http/http_response_headers.h"
 #include "net/http/http_response_info.h"
@@ skipping 284 matching lines @@
   const ResourceRequestInfo* info = ResourceRequestInfo::ForRequest(request);
 
   // We have seen crashes where info is NULL: crbug.com/52374.
   if (!info) {
     LOG(ERROR) << "Allowing load of " << request->url().spec()
                << "from unknown origin. Could not find user data for "
                << "request.";
     return true;
   }
 
-  if (is_incognito && !ExtensionCanLoadInIncognito(info, request->url().host(),
-                                                   extension_info_map)) {
-    return false;
-  }
-
   // The following checks are meant to replicate similar set of checks in the
   // renderer process, performed by ResourceRequestPolicy::CanRequestResource.
   // These are not exactly equivalent, because we don't have the same bits of
   // information. The two checks need to be kept in sync as much as possible, as
   // an exploited renderer can bypass the checks in ResourceRequestPolicy.
 
   // Check if the extension for which this request is made is indeed loaded in
   // the process sending the request. If not, we need to explicitly check if
   // the resource is explicitly accessible or fits in a set of exception cases.
   // Note: This allows a case where two extensions execute in the same renderer
   // process to request each other's resources. We can't do a more precise
   // check, since the renderer can lie about which extension has made the
   // request.
   if (extension_info_map->process_map().Contains(
       request->url().host(), info->GetChildID())) {
     return true;
   }
 
+  // Extensions with webview: allow loading certain resources by guest renderers
+  // with privileged partition IDs as specified in the manifest file.
+  ExtensionRendererState* renderer_state =
+      ExtensionRendererState::GetInstance();
+  ExtensionRendererState::WebViewInfo webview_info;
+  bool is_guest = renderer_state->GetWebViewInfo(info->GetChildID(),
+                                                 info->GetRouteID(),
+                                                 &webview_info);
+  std::string resource_path = request->url().path();
+  if (is_guest &&
+      extensions::WebviewInfo::IsResourceWebviewAccessible(
+            extension, webview_info.partition_id, resource_path)) {
+    return true;
+  }
+
   if (!content::PageTransitionIsWebTriggerable(info->GetPageTransition()))
     return false;
 
   // The following checks require that we have an actual extension object. If we
   // don't have it, allow the request handling to continue with the rest of the
   // checks.
   if (!extension)
     return true;
 
   // Disallow loading of packaged resources for hosted apps. We don't allow
@@ skipping 14 matching lines @@
   // Extensions with web_accessible_resources: allow loading by regular
   // renderers. Since not all subresources are required to be listed in a v2
   // manifest, we must allow all loads if there are any web accessible
   // resources. See http://crbug.com/179127.
   if (extension->manifest_version() < 2 ||
       extensions::WebAccessibleResourcesInfo::HasWebAccessibleResources(
       extension)) {
     return true;
   }
 
+  if (is_incognito && !ExtensionCanLoadInIncognito(info, request->url().host(),
+                                                   extension_info_map)) {
+    return false;
+  }
+
+
   // If there aren't any explicitly marked web accessible resources, the
   // load should be allowed only if it is by DevTools. A close approximation is
   // checking if the extension contains a DevTools page.
   if (extensions::ManifestURL::GetDevToolsPage(extension).is_empty())
     return false;
 
   return true;
 }
 
 // Returns true if the given URL references an icon in the given extension.
@@ skipping 157 matching lines @@
                                     send_cors_header);
 }
 
 }  // namespace
 
 net::URLRequestJobFactory::ProtocolHandler* CreateExtensionProtocolHandler(
     bool is_incognito,
     ExtensionInfoMap* extension_info_map) {
   return new ExtensionProtocolHandler(is_incognito, extension_info_map);
 }