Support webview tag when the container extension is embedded in a webUI

chrome/browser/chrome_content_browser_client.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chrome_content_browser_client.h"
 
 #include <set>
 #include <utility>
 #include <vector>
 
@@ skipping 108 matching lines @@
 #include "content/public/browser/child_process_data.h"
 #include "content/public/browser/child_process_security_policy.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/resource_context.h"
 #include "content/public/browser/site_instance.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_view.h"
 #include "content/public/common/child_process_host.h"
 #include "content/public/common/content_descriptors.h"
+#include "content/public/common/url_utils.h"
 #include "extensions/browser/view_type_utils.h"
 #include "extensions/common/constants.h"
 #include "extensions/common/switches.h"
 #include "grit/generated_resources.h"
 #include "grit/ui_resources.h"
 #include "net/base/escape.h"
 #include "net/base/mime_util.h"
 #include "net/cookies/canonical_cookie.h"
 #include "net/cookies/cookie_options.h"
 #include "net/ssl/ssl_cert_request_info.h"
@@ skipping 650 matching lines @@
     return;
   }
   std::string api_type;
   extra_params->GetString(guestview::kParameterApi, &api_type);
 
   if (api_type == "adview") {
     *guest_delegate  = new AdViewGuest(guest_web_contents);
   } else if (api_type == "webview") {
     *guest_delegate = new WebViewGuest(guest_web_contents);
   } else {
-    NOTREACHED();
+    // NOTREACHED();
   }
 }
 
 void ChromeContentBrowserClient::GuestWebContentsAttached(
     WebContents* guest_web_contents,
     WebContents* embedder_web_contents,
+    const GURL& embedder_frame_url,
     const base::DictionaryValue& extra_params) {
   Profile* profile = Profile::FromBrowserContext(
       embedder_web_contents->GetBrowserContext());
   ExtensionService* service =
       extensions::ExtensionSystem::Get(profile)->extension_service();
   if (!service) {
     NOTREACHED();
     return;
   }
-  const GURL& url = embedder_web_contents->GetSiteInstance()->GetSiteURL();
-  const Extension* extension =
-      service->extensions()->GetExtensionOrAppByURL(url);
+
+  // Only trust |embedder_frame_url| reported by a WebUI renderer.
+  const GURL& embedder_site_url =
+      embedder_web_contents->GetSiteInstance()->GetSiteURL();
+  const Extension* extension = service->extensions()->GetExtensionOrAppByURL(
+      content::HasWebUIScheme(embedder_site_url) ?
+          embedder_frame_url : embedder_site_url);
   if (!extension) {
     // It's ok to return here, since we could be running a browser plugin
     // outside an extension, and don't need to attach a
     // BrowserPluginGuestDelegate in that case;
     // e.g. running with flag --enable-browser-plugin-for-all-view-types.
     return;
   }
 
   GuestView* guest = GuestView::FromWebContents(guest_web_contents);
   if (!guest) {
@@ skipping 1507 matching lines @@
   }
   return NULL;
 }
 
 bool ChromeContentBrowserClient::SupportsBrowserPlugin(
     content::BrowserContext* browser_context, const GURL& site_url) {
   if (CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kEnableBrowserPluginForAllViewTypes))
     return true;
 
+  if (content::HasWebUIScheme(site_url))

[Fady Samuel, 2013/09/12 22:46:46]

We should probably do the same check as above here rather than simply always
allowing BrowserPlugin in WebUI.

[guohui, 2013/09/13 00:04:02]

SupportsBrowserPlugin is called before RenderViewHost is even created, so there
is no way we could check the extension ID at this time point.

Also, this method is only called to determine whether the RenderViewHost should
monitor messages from guests,
https://code.google.com/p/chromium/codesearch#chromium/src/content/browser/re...

we have other checks in places that prevents webview from creation outside of
the context of a component extension with webview permission declared.

+    return true;
+
   Profile* profile = Profile::FromBrowserContext(browser_context);
   ExtensionService* service =
       extensions::ExtensionSystem::Get(profile)->extension_service();
   if (!service)
     return false;
 
   const Extension* extension =
       service->extensions()->GetExtensionOrAppByURL(site_url);
   if (!extension)
     return false;
@@ skipping 181 matching lines @@
 #if defined(USE_NSS)
 crypto::CryptoModuleBlockingPasswordDelegate*
     ChromeContentBrowserClient::GetCryptoPasswordDelegate(
         const GURL& url) {
   return chrome::NewCryptoModuleBlockingDialogDelegate(
       chrome::kCryptoModulePasswordKeygen, url.host());
 }
 #endif
 
 }  // namespace chrome