[M54 merge] Lock down creation of blob:chrome-extension URLs from non-extension processes.

extensions/browser/extension_web_contents_observer.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/browser/extension_web_contents_observer.h"
 
 #include "content/public/browser/child_process_security_policy.h"
 #include "content/public/browser/navigation_details.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_process_host.h"
@@ skipping 45 matching lines @@
   // At the initialization of the render frame, the last committed URL is not
   // reliable, so do not take it into account in determining whether it is an
   // extension frame.
   const Extension* frame_extension =
       GetExtensionFromFrame(render_frame_host, false);
   // This observer is attached to every WebContents, so we are also notified of
   // frames that are not in an extension process.
   if (!frame_extension)
     return;
 
+  // |render_frame_host->GetProcess()| is an extension process. Grant permission
+  // to commit pages from chrome-extension:// origins.
+  content::ChildProcessSecurityPolicy* security_policy =
+      content::ChildProcessSecurityPolicy::GetInstance();
+  int process_id = render_frame_host->GetProcess()->GetID();
+  security_policy->GrantScheme(process_id, extensions::kExtensionScheme);
+  security_policy->GrantScheme(process_id,
+                               extensions::kExtensionResourceScheme);
+
   // Notify the render frame of the view type.
   render_frame_host->Send(new ExtensionMsg_NotifyRenderViewType(
       render_frame_host->GetRoutingID(), GetViewType(web_contents())));
 
   ExtensionsBrowserClient::Get()->RegisterMojoServices(render_frame_host,
                                                        frame_extension);
   ProcessManager::Get(browser_context_)
       ->RegisterRenderFrameHost(web_contents(), render_frame_host,
                                 frame_extension);
 }
@@ skipping 206 matching lines @@
   // Since this is called for all existing RenderFrameHosts during the
   // ExtensionWebContentsObserver's creation, it's possible that not all hosts
   // are ready.
   // We only initialize the frame if the renderer counterpart is live; otherwise
   // we wait for the RenderFrameCreated notification.
   if (render_frame_host->IsRenderFrameLive())
     InitializeRenderFrame(render_frame_host);
 }
 
 }  // namespace extensions