[M54 merge] Lock down creation of blob:chrome-extension URLs from non-extension processes.

chrome/browser/devtools/devtools_ui_bindings.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/devtools/devtools_ui_bindings.h"
 
 #include <stddef.h>
 
 #include <utility>
 
@@ skipping 24 matching lines @@
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/extensions/chrome_manifest_url_handlers.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/common/url_constants.h"
 #include "chrome/grit/generated_resources.h"
 #include "components/infobars/core/confirm_infobar_delegate.h"
 #include "components/infobars/core/infobar.h"
 #include "components/prefs/scoped_user_pref_update.h"
 #include "components/syncable_prefs/pref_service_syncable.h"
 #include "components/zoom/page_zoom.h"
+#include "content/public/browser/child_process_security_policy.h"
 #include "content/public/browser/devtools_external_agent_proxy.h"
 #include "content/public/browser/devtools_external_agent_proxy_delegate.h"
 #include "content/public/browser/navigation_controller.h"
 #include "content/public/browser/navigation_entry.h"
 #include "content/public/browser/notification_source.h"
 #include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/render_process_host.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/user_metrics.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_observer.h"
 #include "content/public/common/renderer_preferences.h"
 #include "content/public/common/url_constants.h"
 #include "extensions/browser/extension_registry.h"
+#include "extensions/common/constants.h"
 #include "extensions/common/permissions/permissions_data.h"
 #include "ipc/ipc_channel.h"
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
 #include "net/http/http_response_headers.h"
 #include "net/url_request/url_fetcher.h"
 #include "net/url_request/url_fetcher_response_writer.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/page_transition_types.h"
 
@@ skipping 944 matching lines @@
         "startPage",
         new base::StringValue(extensions::chrome_manifest_urls::GetDevToolsPage(
                                   extension.get()).spec()));
     extension_info->Set("name", new base::StringValue(extension->name()));
     extension_info->Set("exposeExperimentalAPIs",
                         new base::FundamentalValue(
                             extension->permissions_data()->HasAPIPermission(
                                 extensions::APIPermission::kExperimental)));
     results.Append(std::move(extension_info));
   }
+  if (!results.empty()) {
+    // At least one devtools extension exists; it will need to run in the
+    // devtools process. Grant it permission to load documents with
+    // chrome-extension:// origins.
+    content::ChildProcessSecurityPolicy::GetInstance()->GrantScheme(
+        web_contents_->GetMainFrame()->GetProcess()->GetID(),
+        extensions::kExtensionScheme);
+  }
+
   CallClientFunction("DevToolsAPI.addExtensions",
                      &results, NULL, NULL);
 }
 
 void DevToolsUIBindings::SetDelegate(Delegate* delegate) {
   delegate_.reset(delegate);
 }
 
 void DevToolsUIBindings::AttachTo(
     const scoped_refptr<content::DevToolsAgentHost>& agent_host) {
@@ skipping 67 matching lines @@
 void DevToolsUIBindings::FrontendLoaded() {
   if (frontend_loaded_)
     return;
   frontend_loaded_ = true;
 
   // Call delegate first - it seeds importants bit of information.
   delegate_->OnLoadCompleted();
 
   AddDevToolsExtensionsToClient();
 }