Allow webview API in an unblessed extension process

chrome/browser/extensions/api/webview/webview_api.h

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_EXTENSIONS_API_WEBVIEW_WEBVIEW_API_H_
 #define CHROME_BROWSER_EXTENSIONS_API_WEBVIEW_WEBVIEW_API_H_
 
 #include "chrome/browser/extensions/api/execute_code_function.h"
 
+// WARNING: Webview could be loaded in an unblessed context, thus any new
+// APIs must be guarded with process ID check to prevent abuse by normal
+// renderer processes.

[not at google - send to devlin, 2013/09/25 17:14:03]

To enforce this at another level, consider having all of these functions extend
a WebviewExtensionFunction class which does the process ID check. You may be
able to utilise ExtensionFunction::HasPermission as a first layer of defense;
you may also need to do a bit more plumbing; I'm not totally sure what the
intent of this is.

[guohui, 2013/09/25 22:43:51]

Done.

+
 namespace extensions {
 
 class WebviewClearDataFunction : public AsyncExtensionFunction {
  public:
   DECLARE_EXTENSION_FUNCTION("webview.clearData", WEBVIEW_CLEARDATA);
 
   WebviewClearDataFunction();
 
  protected:
   virtual ~WebviewClearDataFunction();
@@ skipping 148 matching lines @@
   // ExtensionFunction implementation.
   virtual bool RunImpl() OVERRIDE;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(WebviewTerminateFunction);
 };
 
 }  // namespace extensions
 
 #endif  // CHROME_BROWSER_EXTENSIONS_API_WEBVIEW_WEBVIEW_API_H_