Support webview tag when the container extension is embedded in a webUI

chrome/browser/chrome_content_browser_client.cc

Index: chrome/browser/chrome_content_browser_client.cc
diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
index 28382b921452de51c659ab88d84c5da821893bf2..01768aa59ce373024eb67b619dcfb2a5b58da719 100644
--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc
@@ -126,6 +126,7 @@
 #include "content/public/browser/web_contents_view.h"
 #include "content/public/common/child_process_host.h"
 #include "content/public/common/content_descriptors.h"
+#include "content/public/common/url_utils.h"
 #include "extensions/browser/view_type_utils.h"
 #include "extensions/common/constants.h"
 #include "extensions/common/switches.h"
@@ -796,13 +797,14 @@ void ChromeContentBrowserClient::GuestWebContentsCreated(
   } else if (api_type == "webview") {
     *guest_delegate = new WebViewGuest(guest_web_contents);
   } else {
-    NOTREACHED();
+    // NOTREACHED();
   }
 }
 
 void ChromeContentBrowserClient::GuestWebContentsAttached(
     WebContents* guest_web_contents,
     WebContents* embedder_web_contents,
+    const GURL& embedder_frame_url,
     const base::DictionaryValue& extra_params) {
   Profile* profile = Profile::FromBrowserContext(
       embedder_web_contents->GetBrowserContext());
@@ -812,9 +814,13 @@ void ChromeContentBrowserClient::GuestWebContentsAttached(
     NOTREACHED();
     return;
   }
-  const GURL& url = embedder_web_contents->GetSiteInstance()->GetSiteURL();
-  const Extension* extension =
-      service->extensions()->GetExtensionOrAppByURL(url);
+
+  // Only trust |embedder_frame_url| reported by a WebUI renderer.
+  const GURL& embedder_site_url =
+      embedder_web_contents->GetSiteInstance()->GetSiteURL();
+  const Extension* extension = service->extensions()->GetExtensionOrAppByURL(
+      content::HasWebUIScheme(embedder_site_url) ?
+          embedder_frame_url : embedder_site_url);
   if (!extension) {
     // It's ok to return here, since we could be running a browser plugin
     // outside an extension, and don't need to attach a
@@ -2342,6 +2348,9 @@ bool ChromeContentBrowserClient::SupportsBrowserPlugin(
           switches::kEnableBrowserPluginForAllViewTypes))
     return true;
 
+  if (content::HasWebUIScheme(site_url))

[Fady Samuel, 2013/09/12 22:46:46]

We should probably do the same check as above here rather than simply always
allowing BrowserPlugin in WebUI.

[guohui, 2013/09/13 00:04:02]

SupportsBrowserPlugin is called before RenderViewHost is even created, so there
is no way we could check the extension ID at this time point.

Also, this method is only called to determine whether the RenderViewHost should
monitor messages from guests,
https://code.google.com/p/chromium/codesearch#chromium/src/content/browser/re...

we have other checks in places that prevents webview from creation outside of
the context of a component extension with webview permission declared.

+    return true;
+
   Profile* profile = Profile::FromBrowserContext(browser_context);
   ExtensionService* service =
       extensions::ExtensionSystem::Get(profile)->extension_service();