Support webview tag when the container extension is embedded in a webUI

content/browser/browser_plugin/browser_plugin_guest_manager.cc

Index: content/browser/browser_plugin/browser_plugin_guest_manager.cc
diff --git a/content/browser/browser_plugin/browser_plugin_guest_manager.cc b/content/browser/browser_plugin/browser_plugin_guest_manager.cc
index 75de20313331abe2238a35edccd800ee42bfccb3..2660d3e871cbe7941244bf3a886854b1ba4cbab4 100644
--- a/content/browser/browser_plugin/browser_plugin_guest_manager.cc
+++ b/content/browser/browser_plugin/browser_plugin_guest_manager.cc
@@ -16,6 +16,7 @@
 #include "content/public/common/content_switches.h"
 #include "content/public/common/result_codes.h"
 #include "content/public/common/url_constants.h"
+#include "content/public/common/url_utils.h"
 #include "net/base/escape.h"
 #include "ui/base/keycodes/keyboard_codes.h"
 
@@ -70,7 +71,10 @@ BrowserPluginGuest* BrowserPluginGuestManager::CreateGuest(
     guest_site_instance =
         embedder_site_instance->GetRelatedSiteInstance(GURL(params.src));
   } else {
-    const std::string& host = embedder_site_instance->GetSiteURL().host();
+    // Only trust |embedder_frame_url| reported by a WebUI renderer.
+    const GURL& embedder_site_url = embedder_site_instance->GetSiteURL();
+    const std::string& host = content::HasWebUIScheme(embedder_site_url) ?
+         GURL(params.embedder_frame_url).host() : embedder_site_url.host();
 
     std::string url_encoded_partition = net::EscapeQueryParamValue(
         params.storage_partition_id, false);