Support webview tag when the container extension is embedded in a webUI

content/browser/browser_plugin/browser_plugin_guest_manager.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/browser_plugin/browser_plugin_guest_manager.h"
 
 #include "base/command_line.h"
 #include "content/browser/browser_plugin/browser_plugin_guest.h"
 #include "content/browser/browser_plugin/browser_plugin_host_factory.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
@@ skipping 52 matching lines @@
     // iframes instead. We use the src URL sent by the renderer to find the
     // right process in which to place this instance.
     // Note: Since BrowserPlugin doesn't support cross-process navigation,
     // the instance will stay in the initially assigned process, regardless
     // of the site it is navigated to.
     // TODO(nasko): Fix this, and such that cross-process navigations are
     // supported.
     guest_site_instance =
         embedder_site_instance->GetRelatedSiteInstance(GURL(params.src));
   } else {
-    const std::string& host = embedder_site_instance->GetSiteURL().host();
+    const std::string& host = GURL(params.embedder_frame_url).host();

[Fady Samuel, 2013/09/12 21:54:38]

Wow, this is a bit scary. You should only be doing this if the embedder is a
WebUI because we trust WebUI processes. We don't trust embedders to report their
iframes correctly, in general.

[guohui, 2013/09/12 22:06:08]

We got the frame URL 
you mean the frame URL we got when creating BrowserPlugin cannot be trusted in
general?
hmm, so we don't trust them to report iframe URL correctly but we do trust them
to report the top frame URL correctly? Could you please explain a bit more?

[Fady Samuel, 2013/09/12 22:11:21]

The embedder's site instance is a URL generated by the browser process (which is
trusted), the embedder_frame_url is coming from the embedder render process
(which is less trusted).

[guohui, 2013/09/12 22:36:12]

that makes sense, thanks! fixed as suggested.

 
     std::string url_encoded_partition = net::EscapeQueryParamValue(
         params.storage_partition_id, false);
     // The SiteInstance of a given webview tag is based on the fact that it's
     // a guest process in addition to which platform application the tag
     // belongs to and what storage partition is in use, rather than the URL
     // that the tag is being navigated to.
     GURL guest_site(
         base::StringPrintf("%s://%s/%s?%s", chrome::kGuestScheme,
                             host.c_str(),
@@ skipping 181 matching lines @@
     BrowserPluginGuest* guest = it->second->GetBrowserPluginGuest();
     if (embedder_web_contents == guest->embedder_web_contents()) {
       if (guest->UnlockMouseIfNecessary(event))
         return true;
     }
   }
   return false;
 }
 
 }  // namespace content