Support webview tag when the container extension is embedded in a webUI

chrome/common/extensions/api/_api_features.json

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // See c/c/e/features/* to understand this file, in particular feature.h,
 // simple_feature.h, and base_feature_provider.h.
 
 {
   "activityLogPrivate": {
     "dependencies": ["permission:activityLogPrivate"],
@@ skipping 596 matching lines @@
     // Any webpage can use the webstore API.
     "matches": ["http://*/*", "https://*/*"]
   },
   "webstorePrivate": {
     "dependencies": ["permission:webstorePrivate"],
     "contexts": ["blessed_extension"]
   },
   "webview": {
     "internal": true,
     "dependencies": ["permission:webview"],
-    "contexts": ["blessed_extension"]
+    "contexts": ["blessed_extension", "unblessed_extension"]

[Charlie Reis, 2013/09/13 21:17:24]

What does unblessed_extension mean, and why do we need to add it?

[guohui, 2013/09/16 22:27:02]

It means a JavaScript context for an inactive extension, that is for an
extension loaded through iframe. We need this to support webview in an iframed
component extension.

[Charlie Reis, 2013/09/18 17:42:23]

Ok.  Fady and I talked about this and we think it's safe because the API calls
involve a check to see if the embedder has access to the guest it's trying to
access.  Still, this requires a security audit to make sure that normal web
renderer processes can't abuse this API to cause harm, as well as some
safeguards to ensure that new APIs won't pose a risk in the future.  See
http://crbug.com/293724.

[guohui, 2013/09/19 13:48:41]

how should we proceed with the security audit? Do we need to block this CL on
the audit?

[Charlie Reis, 2013/09/19 17:21:22]

I'll need to look over the existing webview API with another security team
member to make sure it can't be abused.  I'll try to schedule some time for it.

Unfortunately, yes, this is a blocking issue for this CL.  We cannot make the
API unblessed until we know that it can't be abused by an exploited web renderer
process.

[guohui, 2013/09/19 17:59:11]

As suggested by Fady, i ll refactor this part into a separate CL.

   },
   "windows": {
     "dependencies": ["api:tabs"],
     "contexts": ["blessed_extension"]
   }
 }