Support webview tag when the container extension is embedded in a webUI

content/browser/browser_plugin/browser_plugin_guest_manager.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/browser_plugin/browser_plugin_guest_manager.h"
 
 #include "base/command_line.h"
 #include "content/browser/browser_plugin/browser_plugin_guest.h"
 #include "content/browser/browser_plugin/browser_plugin_host_factory.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/common/browser_plugin/browser_plugin_constants.h"
 #include "content/common/browser_plugin/browser_plugin_messages.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/user_metrics.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/result_codes.h"
 #include "content/public/common/url_constants.h"
+#include "content/public/common/url_utils.h"
 #include "net/base/escape.h"
 #include "ui/base/keycodes/keyboard_codes.h"
 
 namespace content {
 
 // static
 BrowserPluginHostFactory* BrowserPluginGuestManager::factory_ = NULL;
 
 BrowserPluginGuestManager::BrowserPluginGuestManager()
     : next_instance_id_(browser_plugin::kInstanceIDNone) {
@@ skipping 34 matching lines @@
     // iframes instead. We use the src URL sent by the renderer to find the
     // right process in which to place this instance.
     // Note: Since BrowserPlugin doesn't support cross-process navigation,
     // the instance will stay in the initially assigned process, regardless
     // of the site it is navigated to.
     // TODO(nasko): Fix this, and such that cross-process navigations are
     // supported.
     guest_site_instance =
         embedder_site_instance->GetRelatedSiteInstance(GURL(params.src));
   } else {
-    const std::string& host = embedder_site_instance->GetSiteURL().host();
+    // Only trust |embedder_frame_url| reported by a WebUI renderer.
+    const GURL& embedder_site_url = embedder_site_instance->GetSiteURL();
+    const std::string& host = content::HasWebUIScheme(embedder_site_url) ?
+         GURL(params.embedder_frame_url).host() : embedder_site_url.host();
 
     std::string url_encoded_partition = net::EscapeQueryParamValue(
         params.storage_partition_id, false);
     // The SiteInstance of a given webview tag is based on the fact that it's
     // a guest process in addition to which platform application the tag
     // belongs to and what storage partition is in use, rather than the URL
     // that the tag is being navigated to.
     GURL guest_site(
         base::StringPrintf("%s://%s/%s?%s", chrome::kGuestScheme,
                             host.c_str(),
@@ skipping 181 matching lines @@
     BrowserPluginGuest* guest = it->second->GetBrowserPluginGuest();
     if (embedder_web_contents == guest->embedder_web_contents()) {
       if (guest->UnlockMouseIfNecessary(event))
         return true;
     }
   }
   return false;
 }
 
 }  // namespace content