Lock down the registration of blob:chrome-extension:// URLs

chrome/browser/browser_process_impl.cc

Index: chrome/browser/browser_process_impl.cc
diff --git a/chrome/browser/browser_process_impl.cc b/chrome/browser/browser_process_impl.cc
index 3d002dad6f012a3bcbe1518e242a79e8630b9a7b..fdd10113af47930695717e6f2144bf48b63bb3dd 100644
--- a/chrome/browser/browser_process_impl.cc
+++ b/chrome/browser/browser_process_impl.cc
@@ -78,6 +78,7 @@
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/extensions/chrome_extensions_client.h"
+#include "chrome/common/extensions/extension_process_policy.h"
 #include "chrome/common/features.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/common/switch_utils.h"
@@ -220,10 +221,22 @@ BrowserProcessImpl::BrowserProcessImpl(
       net_log_path, GetNetCaptureModeFromCommandLine(command_line),
       command_line.GetCommandLineString(), chrome::GetChannelString()));
 
-  ChildProcessSecurityPolicy::GetInstance()->RegisterWebSafeScheme(
-      extensions::kExtensionScheme);
-  ChildProcessSecurityPolicy::GetInstance()->RegisterWebSafeScheme(
-      extensions::kExtensionResourceScheme);
+#if defined(ENABLE_EXTENSIONS)
+  // chrome-extension:// URLs are safe to request anywhere, but may only
+  // commit (including in iframes) in extension processes.

[Charlie Reis, 2016/09/29 21:39:37]

nit: Move comment inside the conditional, since it doesn't apply to the else
block.

[ncarter (slow), 2016/09/29 22:04:02]

Done.

+  if (extensions::IsIsolateExtensionsEnabled()) {

[Charlie Reis, 2016/09/29 21:39:37]

Nice.  Agreed that we need this if we want to merge this to M54, where
--isolate-extensions is still part of a Finch trial.

[ncarter (slow), 2016/09/29 22:04:02]

Done. FWIW, I'm a little nervous about consulting the finch config here -- it's
really early in startup -- but I figure if it doesn't work, it should be
obvious.

+    ChildProcessSecurityPolicy::GetInstance()->RegisterWebSafeIsolatedScheme(
+        extensions::kExtensionScheme, true);
+    // TODO(nick): Kill off kExtensionResourceScheme.
+    ChildProcessSecurityPolicy::GetInstance()->RegisterWebSafeIsolatedScheme(
+        extensions::kExtensionResourceScheme, false);
+  } else {
+    ChildProcessSecurityPolicy::GetInstance()->RegisterWebSafeScheme(
+        extensions::kExtensionScheme);
+    ChildProcessSecurityPolicy::GetInstance()->RegisterWebSafeScheme(
+        extensions::kExtensionResourceScheme);
+  }
+#endif
   ChildProcessSecurityPolicy::GetInstance()->RegisterWebSafeScheme(
       chrome::kChromeSearchScheme);