Support webview tag in component extension

chrome/renderer/extensions/dispatcher.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/extensions/dispatcher.h"
 
 #include "base/callback.h"
 #include "base/command_line.h"
 #include "base/debug/alias.h"
 #include "base/json/json_reader.h"
@@ skipping 395 matching lines @@
       webrequest_other_(false),
       source_map_(&ResourceBundle::GetSharedInstance()),
       v8_schema_registry_(new V8SchemaRegistry) {
   const CommandLine& command_line = *(CommandLine::ForCurrentProcess());
   is_extension_process_ =
       command_line.HasSwitch(switches::kExtensionProcess) ||
       command_line.HasSwitch(switches::kSingleProcess);
 
   if (is_extension_process_) {
     RenderThread::Get()->SetIdleNotificationDelayInMs(
         kInitialExtensionIdleHandlerDelayMs);

[not at google - send to devlin, 2013/09/23 20:59:12]

... however, if you do want to just always set the custom element whitelist, you
might as well do it here.

[guohui, 2013/09/23 21:17:57]

i think this will only work for an active extension, but not for extensions
iframed in WebUI. I understand the iframe case is covered in other CLs, but
prefer not to introduce code that we know will break for iframe case unless
necessary.

   }
 
   RenderThread::Get()->RegisterExtension(SafeBuiltins::CreateV8Extension());
 
   user_script_slave_.reset(new UserScriptSlave(&extensions_));
   request_sender_.reset(new RequestSender(this));
   PopulateSourceMap();
   PopulateLazyBindingsMap();
 }
 
@@ skipping 45 matching lines @@
 
   // Initialize host permissions for any extensions that were activated before
   // WebKit was initialized.
   for (std::set<std::string>::iterator iter = active_extension_ids_.begin();
        iter != active_extension_ids_.end(); ++iter) {
     const Extension* extension = extensions_.GetByID(*iter);
     CHECK(extension);
     InitOriginPermissions(extension);
   }
 
-  if (IsWithinPlatformApp())
-    EnableCustomElementWhiteList();
+  EnableCustomElementWhiteList();

[not at google - send to devlin, 2013/09/20 16:44:34]

could you guard this with the webview permission check?

[guohui, 2013/09/23 18:34:10]

But we don't have the extension ID here to check for webview perission.

And as commented by dominic, the only side effect is that webview "will have
HTMLElement as their interface instead of HTMLUnknownElement".

[not at google - send to devlin, 2013/09/23 20:59:12]

A few lines above we loop over the extensions; you could initialize the custom
element whitelist from within there.

[guohui, 2013/09/23 21:17:57]

but we only loop over "active" extensions above, and thus it will not work for
extensions iframed in webUI.

 
   is_webkit_initialized_ = true;
 }
 
 void Dispatcher::IdleNotification() {
   if (is_extension_process_) {
     // Dampen the forced delay as well if the extension stays idle for long
     // periods of time.
     int64 forced_delay_ms = std::max(
         RenderThread::Get()->GetIdleNotificationDelayInMs(),
@@ skipping 613 matching lines @@
   }
 
   if (context_type == Feature::BLESSED_EXTENSION_CONTEXT &&
       is_within_platform_app &&
       GetCurrentChannel() <= chrome::VersionInfo::CHANNEL_DEV &&
       CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kEnableAppWindowControls)) {
     module_system->Require("windowControls");
   }
 
-  // Only platform apps support the <webview> tag, because the "webView" and
-  // "denyWebView" modules will affect the performance of DOM modifications
-  // (http://crbug.com/196453).
-  if (context_type == Feature::BLESSED_EXTENSION_CONTEXT &&
-      is_within_platform_app) {
+  // Currently only platform apps and whitelisted component extensions support
+  // the <webview> tag, because the "webView" and "denyWebView" modules will
+  // affect the performance of DOM modifications (http://crbug.com/196453).
+  if (context_type == Feature::BLESSED_EXTENSION_CONTEXT) {
     // Note: setting up the WebView class here, not the chrome.webview API.
     // The API will be automatically set up when first used.
     if (extension->HasAPIPermission(APIPermission::kWebView)) {
       module_system->Require("webView");
       bool includeExperimental =
           GetCurrentChannel() <= chrome::VersionInfo::CHANNEL_DEV ||
           extension->id() == extension_misc::kIdentityApiUiAppId;
       if (!includeExperimental) {
         // TODO(asargent) We need a whitelist for webview experimental.
         // crbug.com/264852
         std::string id_hash = base::SHA1HashString(extension->id());
         std::string hexencoded_id_hash = base::HexEncode(id_hash.c_str(),
                                                          id_hash.length());
         if (hexencoded_id_hash == "8C3741E3AF0B93B6E8E0DDD499BB0B74839EA578" ||
             hexencoded_id_hash == "E703483CEF33DEC18B4B6DD84B5C776FB9182BDB" ||
             hexencoded_id_hash == "1A26E32DE447A17CBE5E9750CDBA78F58539B39C" ||
             hexencoded_id_hash == "59048028102D7B4C681DBC7BC6CD980C3DC66DA3")
           includeExperimental = true;
       }
       if (includeExperimental)
         module_system->Require("webViewExperimental");
     } else {
       module_system->Require("denyWebView");

[not at google - send to devlin, 2013/09/20 16:44:34]

I particularly like that we're injecting this into every extension context now;
do we still need denyWebView or does the custom element whitelist cover that?

@fady

[not at google - send to devlin, 2013/09/20 16:45:25]

Err. *don't* particularly.

[guohui, 2013/09/23 19:38:11]

as discussed offline with Fady, the purpose of denyWebView module is to show a
console error when webview tag is used without proper permission. Since it does
have performance issue, we should only inject it for platform apps instead of
all extensions, until the perf issue is fixed with custom tag.

Fixed in a new patch.

     }
   }
 
   // Same comment as above for <adview> tag.
   if (context_type == Feature::BLESSED_EXTENSION_CONTEXT &&
       is_within_platform_app) {
     if (CommandLine::ForCurrentProcess()->HasSwitch(switches::kEnableAdview)) {
       if (extension->HasAPIPermission(APIPermission::kAdView)) {
         module_system->Require("adView");
       } else {
@@ skipping 90 matching lines @@
   if (is_webkit_initialized_) {
     InitOriginPermissions(extension);
     // DOMActivity logger for a main world controlled by an extension (as in
     // the case of an extension background page, options page, popup etc.)
     // gets an empty title.
     DOMActivityLogger::AttachToWorld(DOMActivityLogger::kMainWorldId,
                                      extension_id,
                                      extension->url(),
                                      string16());
 
-    if (IsWithinPlatformApp())
-      EnableCustomElementWhiteList();
+    EnableCustomElementWhiteList();

[not at google - send to devlin, 2013/09/20 16:44:34]

likewise

[not at google - send to devlin, 2013/09/23 20:59:12]

... and here, we do know what the extension is.

[guohui, 2013/09/23 21:17:57]

yes i could add webview check here, though i think if we always call
EnableCustomElementWhiteList in WebkitInitialized above, then we don't need to
call it again here.

   }
 }
 
 void Dispatcher::InitOriginPermissions(const Extension* extension) {
   // TODO(jstritar): We should try to remove this special case. Also, these
   // whitelist entries need to be updated when the kManagement permission
   // changes.
   if (extension->HasAPIPermission(APIPermission::kManagement)) {
     WebSecurityPolicy::addOriginAccessWhitelistEntry(
         extension->url(),
@@ skipping 302 matching lines @@
     RenderView* background_view =
         ExtensionHelper::GetBackgroundPage(extension_id);
     if (background_view) {
       background_view->Send(new ExtensionHostMsg_EventAck(
           background_view->GetRoutingID()));
     }
   }
 }
 
 }  // namespace extensions