Fix blob URL blocking for apps that use <webview>.

Fix blob URL blocking for apps that use <webview>.

It should be possible for an app to embed a <webview> and navigate it
to a blob URL that the app creates.  In a previous security fix
(r419019), this navigation was unintentionally blocked, due to
<webview> being considered a main frame as well as being in an
untrusted web process which is requesting a blob URL in a
chrome-extension:// scheme.

BUG=652077, 645028
Committed: https://crrev.com/cd20702d3b3dd5224beaa7fd7b876313b33b6b70
Cr-Commit-Position: refs/heads/master@{#422954}

[alexmos, 2016-10-04 04:58:18]

The CQ bit was checked by alexmos@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-10-04 04:58:34]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-10-04 05:44:50]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-10-04 05:44:50]

Dry run: This issue passed the CQ dry run.

[alexmos, 2016-10-04 19:08:25]

Description was changed from

==========
Fix blob URL blocking for platform apps.

BUG=652077
==========

to

==========
Fix blob URL blocking for apps that use <webview>.

It should be possible for an app to embed a <webview> and navigate it
to a blob URL that the app creates.  In a previous security fix
(r419019), this navigation was unintentionally blocked, due to
<webview> being considered a main frame as well as being in an
untrusted web process which is requesting a blob URL in a
chrome-extension:// scheme.

BUG=652077
==========

[alexmos, 2016-10-04 19:08:33]

The CQ bit was checked by alexmos@chromium.org to run a CQ dry run

[alexmos, 2016-10-04 19:08:53]

Description was changed from

==========
Fix blob URL blocking for apps that use <webview>.

It should be possible for an app to embed a <webview> and navigate it
to a blob URL that the app creates.  In a previous security fix
(r419019), this navigation was unintentionally blocked, due to
<webview> being considered a main frame as well as being in an
untrusted web process which is requesting a blob URL in a
chrome-extension:// scheme.

BUG=652077
==========

to

==========
Fix blob URL blocking for apps that use <webview>.

It should be possible for an app to embed a <webview> and navigate it
to a blob URL that the app creates.  In a previous security fix
(r419019), this navigation was unintentionally blocked, due to
<webview> being considered a main frame as well as being in an
untrusted web process which is requesting a blob URL in a
chrome-extension:// scheme.

BUG=652077
==========

[commit-bot: I haz the power, 2016-10-04 19:09:02]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[alexmos, 2016-10-04 19:11:34]

alexmos@chromium.org changed reviewers:
+ creis@chromium.org, nasko@chromium.org, wjmaclean@chromium.org

[alexmos, 2016-10-04 19:11:35]

Charlie/Nasko, please take a look.
James: please review the new WebView test.

[Charlie Reis, 2016-10-04 19:54:36]

Thanks, LGTM.  Please also list 645028 in the CL description.

(Let's chat about whether there are ways around this that we should lock down
further, but I think it makes sense to proceed with at least this much ASAP.)

https://codereview.chromium.org/2387323002/diff/40001/chrome/test/data/extens...
File chrome/test/data/extensions/platform_apps/web_view/shim/main.js (right):

https://codereview.chromium.org/2387323002/diff/40001/chrome/test/data/extens...
chrome/test/data/extensions/platform_apps/web_view/shim/main.js:2962: // This
test verifies that mailto links are enabled.
nit: Stale comment.

[alexmos, 2016-10-04 20:00:43]

The CQ bit was checked by alexmos@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-10-04 20:00:58]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[alexmos, 2016-10-04 20:01:59]

https://codereview.chromium.org/2387323002/diff/40001/chrome/test/data/extens...
File chrome/test/data/extensions/platform_apps/web_view/shim/main.js (right):

https://codereview.chromium.org/2387323002/diff/40001/chrome/test/data/extens...
chrome/test/data/extensions/platform_apps/web_view/shim/main.js:2962: // This
test verifies that mailto links are enabled.
On 2016/10/04 19:54:36, Charlie Reis wrote:
> nit: Stale comment.

Done.

[wjmaclean, 2016-10-04 20:39:42]

On 2016/10/04 20:01:59, alexmos wrote:
>
https://codereview.chromium.org/2387323002/diff/40001/chrome/test/data/extens...
> File chrome/test/data/extensions/platform_apps/web_view/shim/main.js (right):
> 
>
https://codereview.chromium.org/2387323002/diff/40001/chrome/test/data/extens...
> chrome/test/data/extensions/platform_apps/web_view/shim/main.js:2962: // This
> test verifies that mailto links are enabled.
> On 2016/10/04 19:54:36, Charlie Reis wrote:
> > nit: Stale comment.
> 
> Done.

LGTM, thanks!

[alexmos, 2016-10-04 20:41:35]

Description was changed from

==========
Fix blob URL blocking for apps that use <webview>.

It should be possible for an app to embed a <webview> and navigate it
to a blob URL that the app creates.  In a previous security fix
(r419019), this navigation was unintentionally blocked, due to
<webview> being considered a main frame as well as being in an
untrusted web process which is requesting a blob URL in a
chrome-extension:// scheme.

BUG=652077
==========

to

==========
Fix blob URL blocking for apps that use <webview>.

It should be possible for an app to embed a <webview> and navigate it
to a blob URL that the app creates.  In a previous security fix
(r419019), this navigation was unintentionally blocked, due to
<webview> being considered a main frame as well as being in an
untrusted web process which is requesting a blob URL in a
chrome-extension:// scheme.

BUG=652077,645028
==========

[alexmos, 2016-10-04 20:43:52]

alexmos@chromium.org changed reviewers:
+ thestig@chromium.org

[alexmos, 2016-10-04 20:43:53]

thestig@: can you please review
chrome/browser/net/chrome_extensions_network_delegate.cc for OWNERS?

[Lei Zhang, 2016-10-04 20:45:31]

Wouldn't chrome/browser/net/OWNERS be better?

[alexmos, 2016-10-04 21:07:58]

On 2016/10/04 20:45:31, Lei Zhang wrote:
> Wouldn't chrome/browser/net/OWNERS be better?

I saw that you touched large parts of that file, so thought you might be
familiar with it.  I'll try to find someone available in chrome/browser/net/. 
This is a pretty urgent fix that would be great to get into today's canary, as
we need it to bake and merge to M54 before branch.

[nasko, 2016-10-04 21:26:43]

LGTM

[Lei Zhang, 2016-10-04 21:32:30]

On 2016/10/04 21:07:58, alexmos wrote:
> On 2016/10/04 20:45:31, Lei Zhang wrote:
> > Wouldn't chrome/browser/net/OWNERS be better?
> 
> I saw that you touched large parts of that file, so thought you might be
> familiar with it.  I'll try to find someone available in chrome/browser/net/. 
> This is a pretty urgent fix that would be great to get into today's canary, as
> we need it to bake and merge to M54 before branch.

It's true, but IIRC, I mostly just refactored the code.

[commit-bot: I haz the power, 2016-10-04 21:39:14]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-10-04 21:39:15]

Dry run: This issue passed the CQ dry run.

[eroman, 2016-10-04 21:54:04]

eroman@chromium.org changed reviewers:
+ eroman@chromium.org

[eroman, 2016-10-04 21:54:04]

lgtm

[alexmos, 2016-10-04 22:01:33]

The CQ bit was checked by alexmos@chromium.org

[alexmos, 2016-10-04 22:01:33]

The patchset sent to the CQ was uploaded after l-g-t-m from creis@chromium.org
Link to the patchset: https://codereview.chromium.org/2387323002/#ps60001
(title: "Fix comment")

[commit-bot: I haz the power, 2016-10-04 22:03:08]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-10-04 22:09:50]

Description was changed from

==========
Fix blob URL blocking for apps that use <webview>.

It should be possible for an app to embed a <webview> and navigate it
to a blob URL that the app creates.  In a previous security fix
(r419019), this navigation was unintentionally blocked, due to
<webview> being considered a main frame as well as being in an
untrusted web process which is requesting a blob URL in a
chrome-extension:// scheme.

BUG=652077,645028
==========

to

==========
Fix blob URL blocking for apps that use <webview>.

It should be possible for an app to embed a <webview> and navigate it
to a blob URL that the app creates.  In a previous security fix
(r419019), this navigation was unintentionally blocked, due to
<webview> being considered a main frame as well as being in an
untrusted web process which is requesting a blob URL in a
chrome-extension:// scheme.

BUG=652077,645028
==========

[commit-bot: I haz the power, 2016-10-04 22:09:51]

Committed patchset #4 (id:60001)

[commit-bot: I haz the power, 2016-10-04 22:11:39]

Description was changed from

==========
Fix blob URL blocking for apps that use <webview>.

It should be possible for an app to embed a <webview> and navigate it
to a blob URL that the app creates.  In a previous security fix
(r419019), this navigation was unintentionally blocked, due to
<webview> being considered a main frame as well as being in an
untrusted web process which is requesting a blob URL in a
chrome-extension:// scheme.

BUG=652077,645028
==========

to

==========
Fix blob URL blocking for apps that use <webview>.

It should be possible for an app to embed a <webview> and navigate it
to a blob URL that the app creates.  In a previous security fix
(r419019), this navigation was unintentionally blocked, due to
<webview> being considered a main frame as well as being in an
untrusted web process which is requesting a blob URL in a
chrome-extension:// scheme.

BUG=652077,645028

Committed: https://crrev.com/cd20702d3b3dd5224beaa7fd7b876313b33b6b70
Cr-Commit-Position: refs/heads/master@{#422954}
==========

[commit-bot: I haz the power, 2016-10-04 22:11:41]

Patchset 4 (id:??) landed as
https://crrev.com/cd20702d3b3dd5224beaa7fd7b876313b33b6b70
Cr-Commit-Position: refs/heads/master@{#422954}