Allow navigations to non-web-accessible resources from chrome schemes.

chrome/browser/extensions/chrome_content_browser_client_extensions_part.cc

Index: chrome/browser/extensions/chrome_content_browser_client_extensions_part.cc
diff --git a/chrome/browser/extensions/chrome_content_browser_client_extensions_part.cc b/chrome/browser/extensions/chrome_content_browser_client_extensions_part.cc
index e192ef01251f3407f0f3897a8cdbe1d22b34b17d..3ee16a0b2809db2a362fc309ba20a15f9bb098ee 100644
--- a/chrome/browser/extensions/chrome_content_browser_client_extensions_part.cc
+++ b/chrome/browser/extensions/chrome_content_browser_client_extensions_part.cc
@@ -25,6 +25,7 @@
 #include "chrome/common/chrome_constants.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/extensions/extension_process_policy.h"
+#include "chrome/common/url_constants.h"
 #include "components/guest_view/browser/guest_view_message_filter.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/browser_url_handler.h"
@@ -36,6 +37,7 @@
 #include "content/public/browser/vpn_service_proxy.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/common/url_constants.h"
 #include "extensions/browser/api/web_request/web_request_api.h"
 #include "extensions/browser/api/web_request/web_request_api_helpers.h"
 #include "extensions/browser/bad_message.h"
@@ -521,7 +523,6 @@ bool ChromeContentBrowserClientExtensionsPart::ShouldAllowOpenURL(
     const GURL& to_url,
     bool* result) {
   DCHECK(result);
-
   // Using url::Origin is important to properly handle blob: and filesystem:
   // URLs.
   url::Origin to_origin(to_url);
@@ -531,6 +532,15 @@ bool ChromeContentBrowserClientExtensionsPart::ShouldAllowOpenURL(
     return false;
   }
 
+  // Navigations from chrome:// or chrome-search:// pages need to be allowed,
+  // even if |to_url| is not web-accessible.  See https://crbug.com/662602.
+  GURL site_url(site_instance->GetSiteURL());
+  if (site_url.SchemeIs(content::kChromeUIScheme) ||
+      site_url.SchemeIs(chrome::kChromeSearchScheme)) {

[ncarter (slow), 2016/11/09 18:44:21]

Are we sure we want to allow this for extension blob/filesystem targets too? Or
can we limit this to "&& to_url.SchemeIs(kExtensionScheme)" ?

I don't have a particular case in mind, other than minimizing privileges.

[alexmos, 2016/11/09 22:20:31]

Done, given the observation that Blink already blocks this.  Instead of adding
the scheme check, I just moved this down to happen after the nested URL check
(and added a comment).  Can you check if that makes sense?

+    *result = true;
+    return true;
+  }
+
   // Do not allow pages from the web or other extensions navigate to
   // non-web-accessible extension resources.
 
@@ -543,7 +553,6 @@ bool ChromeContentBrowserClientExtensionsPart::ShouldAllowOpenURL(
     return true;
   }
 
-  GURL site_url(site_instance->GetSiteURL());
   const Extension* from_extension =
       registry->enabled_extensions().GetExtensionOrAppByURL(site_url);
   if (from_extension && from_extension == to_extension) {