Tighten IO thread blob/filesystem URL checks for apps with webview permission.

content/public/browser/child_process_security_policy.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_PUBLIC_BROWSER_CHILD_PROCESS_SECURITY_POLICY_H_
 #define CONTENT_PUBLIC_BROWSER_CHILD_PROCESS_SECURITY_POLICY_H_
 
 #include <string>
 
 #include "content/common/content_export.h"
@@ skipping 181 matching lines @@
   virtual bool HasWebUIBindings(int child_id) = 0;
 
   // Grants permission to send system exclusive message to any MIDI devices.
   virtual void GrantSendMidiSysExMessage(int child_id) = 0;
 
   // Returns true if the process is permitted to read and modify the data for
   // the given origin. This is currently used for cookies and passwords.
   // Does not affect cookies attached to or set by network requests.
   // Only might return false if the --site-per-process flag is used.
   virtual bool CanAccessDataForOrigin(int child_id, const GURL& gurl) = 0;
+
+  // Returns true if GrantOrigin was called earlier with the same parameters.
+  //
+  // TODO(alexmos): This currently exists to support checking whether a
+  // <webview> guest process has permission to request blob URLs in its
+  // embedder's origin on the IO thread.  This should be removed once that
+  // check is superseded by a UI thread check.  See https://crbug.com/656752.
+  virtual bool HasSpecificPermissionForOrigin(int child_id,
+                                              const url::Origin& origin) = 0;
 };
 
 }  // namespace content
 
 #endif  // CONTENT_PUBLIC_BROWSER_CHILD_PROCESS_SECURITY_POLICY_H_