Allow <webview> to access URLs in the origin of the app embedding it.

Allow <webview> to access URLs in the origin of the app embedding it.

With r422474 creation of blob: URLs with origin of a chrome-extension://
was locked down. However, the case of a <webview> loading an
accessible_resource from its embedder and creating a blob: is disallowed.
This CL adds permission for <webview> to create such URLs in the origin
of its embedder.

This CL is based on work by nick@chromium.org.

BUG=652784, 644966
Committed: https://crrev.com/5edda59b0b1cb8fff058b47567ac32e58be5168a
Cr-Commit-Position: refs/heads/master@{#422976}

[nasko, 2016-10-04 19:21:38]

The CQ bit was checked by nasko@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-10-04 19:22:27]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[nasko, 2016-10-04 19:22:55]

nasko@chromium.org changed reviewers:
+ creis@chromium.org, wjmaclean@chromium.org

[nasko, 2016-10-04 19:22:56]

Hey Charlie and James,
Can you review this CL?
Thanks in advance!
Nasko

[nasko, 2016-10-04 19:23:28]

Description was changed from

==========
Allow <webview> to access URLs in the origin of the app embedding it.

With r422474 creation of blob: URLs with origin of a chrome-extension://
was locked down. However, the case of a <webview> loading an
accessible_resource from its embedder and creating a blob: is disallowed.
This CL adds permission for <webview> to create such URLs in the origin
of its embedder.

BUG=652784
==========

to

==========
Allow <webview> to access URLs in the origin of the app embedding it.

With r422474 creation of blob: URLs with origin of a chrome-extension://
was locked down. However, the case of a <webview> loading an
accessible_resource from its embedder and creating a blob: is disallowed.
This CL adds permission for <webview> to create such URLs in the origin
of its embedder.

This CL is based on work by nick@chromium.org.

BUG=652784
==========

[Charlie Reis, 2016-10-04 19:59:40]

LGTM, thanks.  Let's also list 644966 in the CL description, since we may need
to merge both this and the original fix.

[commit-bot: I haz the power, 2016-10-04 20:24:26]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-10-04 20:24:26]

Dry run: This issue passed the CQ dry run.

[nasko, 2016-10-04 21:02:58]

Description was changed from

==========
Allow <webview> to access URLs in the origin of the app embedding it.

With r422474 creation of blob: URLs with origin of a chrome-extension://
was locked down. However, the case of a <webview> loading an
accessible_resource from its embedder and creating a blob: is disallowed.
This CL adds permission for <webview> to create such URLs in the origin
of its embedder.

This CL is based on work by nick@chromium.org.

BUG=652784
==========

to

==========
Allow <webview> to access URLs in the origin of the app embedding it.

With r422474 creation of blob: URLs with origin of a chrome-extension://
was locked down. However, the case of a <webview> loading an
accessible_resource from its embedder and creating a blob: is disallowed.
This CL adds permission for <webview> to create such URLs in the origin
of its embedder.

This CL is based on work by nick@chromium.org.

BUG=652784, 644966
==========

[nasko, 2016-10-04 22:03:37]

nasko@chromium.org changed reviewers:
+ lazyboy@chromium.org

[nasko, 2016-10-04 22:03:38]

Adding lazyboy@ for OWNERS review.

[wjmaclean, 2016-10-04 22:11:23]

lgtm

[lazyboy, 2016-10-04 22:15:32]

web_view lgtm with one comment.

https://codereview.chromium.org/2396533003/diff/1/chrome/test/data/extensions...
File
chrome/test/data/extensions/platform_apps/web_view/guest_focus_test/guest.js
(right):

https://codereview.chromium.org/2396533003/diff/1/chrome/test/data/extensions...
chrome/test/data/extensions/platform_apps/web_view/guest_focus_test/guest.js:20:
URL.createObjectURL(new Blob([]));
This seems unrelated to this test.
If you're in a rush, you should at least put a comment and a TODO to extract
this to a separate test.

[nasko, 2016-10-04 22:37:45]

On 2016/10/04 22:15:32, lazyboy wrote:
> web_view lgtm with one comment.
> 
>
https://codereview.chromium.org/2396533003/diff/1/chrome/test/data/extensions...
> File
> chrome/test/data/extensions/platform_apps/web_view/guest_focus_test/guest.js
> (right):
> 
>
https://codereview.chromium.org/2396533003/diff/1/chrome/test/data/extensions...
>
chrome/test/data/extensions/platform_apps/web_view/guest_focus_test/guest.js:20:
> URL.createObjectURL(new Blob([]));
> This seems unrelated to this test.
> If you're in a rush, you should at least put a comment and a TODO to extract
> this to a separate test.

Yes, it is unrelated, however any other place I looked at to put it in were
strictly worse. I have a list of follow ups for those tests and I'll make sure
it gets addressed. I want to avoid adding a TODO, since I need this to land
today : (.
Thanks for the review!

[nasko, 2016-10-04 22:37:52]

The CQ bit was checked by nasko@chromium.org

[commit-bot: I haz the power, 2016-10-04 22:38:12]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[lazyboy, 2016-10-04 22:39:33]

On 2016/10/04 22:37:45, nasko (slow) wrote:
> On 2016/10/04 22:15:32, lazyboy wrote:
> > web_view lgtm with one comment.
> > 
> >
>
https://codereview.chromium.org/2396533003/diff/1/chrome/test/data/extensions...
> > File
> > chrome/test/data/extensions/platform_apps/web_view/guest_focus_test/guest.js
> > (right):
> > 
> >
>
https://codereview.chromium.org/2396533003/diff/1/chrome/test/data/extensions...
> >
>
chrome/test/data/extensions/platform_apps/web_view/guest_focus_test/guest.js:20:
> > URL.createObjectURL(new Blob([]));
> > This seems unrelated to this test.
> > If you're in a rush, you should at least put a comment and a TODO to extract
> > this to a separate test.
> 
> Yes, it is unrelated, however any other place I looked at to put it in were
> strictly worse. I have a list of follow ups for those tests and I'll make sure
> it gets addressed.
Ok thanks. SLGTM.
 I want to avoid adding a TODO, since I need this to land
> today : (.
> Thanks for the review!

[commit-bot: I haz the power, 2016-10-04 22:45:13]

Description was changed from

==========
Allow <webview> to access URLs in the origin of the app embedding it.

With r422474 creation of blob: URLs with origin of a chrome-extension://
was locked down. However, the case of a <webview> loading an
accessible_resource from its embedder and creating a blob: is disallowed.
This CL adds permission for <webview> to create such URLs in the origin
of its embedder.

This CL is based on work by nick@chromium.org.

BUG=652784, 644966
==========

to

==========
Allow <webview> to access URLs in the origin of the app embedding it.

With r422474 creation of blob: URLs with origin of a chrome-extension://
was locked down. However, the case of a <webview> loading an
accessible_resource from its embedder and creating a blob: is disallowed.
This CL adds permission for <webview> to create such URLs in the origin
of its embedder.

This CL is based on work by nick@chromium.org.

BUG=652784, 644966
==========

[commit-bot: I haz the power, 2016-10-04 22:45:14]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-10-04 22:48:02]

Description was changed from

==========
Allow <webview> to access URLs in the origin of the app embedding it.

With r422474 creation of blob: URLs with origin of a chrome-extension://
was locked down. However, the case of a <webview> loading an
accessible_resource from its embedder and creating a blob: is disallowed.
This CL adds permission for <webview> to create such URLs in the origin
of its embedder.

This CL is based on work by nick@chromium.org.

BUG=652784, 644966
==========

to

==========
Allow <webview> to access URLs in the origin of the app embedding it.

With r422474 creation of blob: URLs with origin of a chrome-extension://
was locked down. However, the case of a <webview> loading an
accessible_resource from its embedder and creating a blob: is disallowed.
This CL adds permission for <webview> to create such URLs in the origin
of its embedder.

This CL is based on work by nick@chromium.org.

BUG=652784, 644966

Committed: https://crrev.com/5edda59b0b1cb8fff058b47567ac32e58be5168a
Cr-Commit-Position: refs/heads/master@{#422976}
==========

[commit-bot: I haz the power, 2016-10-04 22:48:03]

Patchset 1 (id:??) landed as
https://crrev.com/5edda59b0b1cb8fff058b47567ac32e58be5168a
Cr-Commit-Position: refs/heads/master@{#422976}