Support webview tag when the container extension is embedded in a webUI

content/browser/browser_plugin/browser_plugin_guest_manager.cc

Index: content/browser/browser_plugin/browser_plugin_guest_manager.cc
diff --git a/content/browser/browser_plugin/browser_plugin_guest_manager.cc b/content/browser/browser_plugin/browser_plugin_guest_manager.cc
index 75de20313331abe2238a35edccd800ee42bfccb3..de8f8dac03ac61857e6d3dd49272b57e14b23102 100644
--- a/content/browser/browser_plugin/browser_plugin_guest_manager.cc
+++ b/content/browser/browser_plugin/browser_plugin_guest_manager.cc
@@ -70,7 +70,7 @@ BrowserPluginGuest* BrowserPluginGuestManager::CreateGuest(
     guest_site_instance =
         embedder_site_instance->GetRelatedSiteInstance(GURL(params.src));
   } else {
-    const std::string& host = embedder_site_instance->GetSiteURL().host();
+    const std::string& host = GURL(params.embedder_frame_url).host();

[Fady Samuel, 2013/09/12 21:54:38]

Wow, this is a bit scary. You should only be doing this if the embedder is a
WebUI because we trust WebUI processes. We don't trust embedders to report their
iframes correctly, in general.

[guohui, 2013/09/12 22:06:08]

We got the frame URL 
you mean the frame URL we got when creating BrowserPlugin cannot be trusted in
general?
hmm, so we don't trust them to report iframe URL correctly but we do trust them
to report the top frame URL correctly? Could you please explain a bit more?

[Fady Samuel, 2013/09/12 22:11:21]

The embedder's site instance is a URL generated by the browser process (which is
trusted), the embedder_frame_url is coming from the embedder render process
(which is less trusted).

[guohui, 2013/09/12 22:36:12]

that makes sense, thanks! fixed as suggested.

 
     std::string url_encoded_partition = net::EscapeQueryParamValue(
         params.storage_partition_id, false);