[M54 merge] Lock down creation of blob:chrome-extension URLs from non-extension processes.

content/browser/loader/resource_dispatcher_host_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // See http://dev.chromium.org/developers/design-documents/multi-process-resource-loading
 
 #include "content/browser/loader/resource_dispatcher_host_impl.h"
 
 #include <stddef.h>
 
@@ skipping 2673 matching lines @@
             << request_data.url.possibly_invalid_spec();
     return false;
   }
 
   // Check if the renderer is using an illegal Origin header.  If so, kill it.
   std::string origin_string;
   bool has_origin =
       headers.GetHeader("Origin", &origin_string) && origin_string != "null";
   if (has_origin) {
     GURL origin(origin_string);
-    if (!policy->CanCommitURL(child_id, origin)) {
+    if (!policy->CanSetAsOriginHeader(child_id, origin)) {
       VLOG(1) << "Killed renderer for illegal origin: " << origin_string;
       bad_message::ReceivedBadMessage(filter, bad_message::RDH_ILLEGAL_ORIGIN);
       return false;
     }
   }
 
   // Check if the renderer is permitted to upload the requested files.
   if (request_data.request_body.get()) {
     const std::vector<ResourceRequestBodyImpl::Element>* uploads =
         request_data.request_body->elements();
@@ skipping 14 matching lines @@
                        << iter->filesystem_url().spec();
           return false;
         }
       }
     }
   }
   return true;
 }
 
 }  // namespace content