Allow webview API in an unblessed extension process

chrome/browser/extensions/api/webview/webview_api.h

Index: chrome/browser/extensions/api/webview/webview_api.h
diff --git a/chrome/browser/extensions/api/webview/webview_api.h b/chrome/browser/extensions/api/webview/webview_api.h
index 59f9d975073894e00ac898bb040e93f78bc46583..29502d2ca65b1488a18d262647dc5891911c7d67 100644
--- a/chrome/browser/extensions/api/webview/webview_api.h
+++ b/chrome/browser/extensions/api/webview/webview_api.h
@@ -7,6 +7,10 @@
 
 #include "chrome/browser/extensions/api/execute_code_function.h"
 
+// WARNING: Webview could be loaded in an unblessed context, thus any new
+// APIs must be guarded with process ID check to prevent abuse by normal
+// renderer processes.

[not at google - send to devlin, 2013/09/25 17:14:03]

To enforce this at another level, consider having all of these functions extend
a WebviewExtensionFunction class which does the process ID check. You may be
able to utilise ExtensionFunction::HasPermission as a first layer of defense;
you may also need to do a bit more plumbing; I'm not totally sure what the
intent of this is.

[guohui, 2013/09/25 22:43:51]

Done.

+
 namespace extensions {
 
 class WebviewClearDataFunction : public AsyncExtensionFunction {