Share schemes needed for mixed content checking between the browser and renderer.

extensions/renderer/dispatcher.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/renderer/dispatcher.h"
 
 #include <stddef.h>
 
 #include <memory>
 #include <utility>
@@ skipping 232 matching lines @@
   // ExtensionAPIEnabledInExtensionServiceWorkers(), but the Dispatcher is
   // created so early that sending an IPC from browser/ process to synchronize
   // this enabled-ness is too late.
   WorkerThreadDispatcher::Get()->Init(RenderThread::Get());
 
   RenderThread::Get()->RegisterExtension(SafeBuiltins::CreateV8Extension());
 
   // Register WebSecurityPolicy whitelists for the chrome-extension:// scheme.
   WebString extension_scheme(base::ASCIIToUTF16(kExtensionScheme));
 
-  // Treat as secure because communication with them is entirely in the browser,
-  // so there is no danger of manipulation or eavesdropping on communication
-  // with them by third parties.
-  WebSecurityPolicy::registerURLSchemeAsSecure(extension_scheme);
-
-  // As far as Blink is concerned, they should be allowed to receive CORS
-  // requests. At the Extensions layer, requests will actually be blocked unless
-  // overridden by the web_accessible_resources manifest key.
-  // TODO(kalman): See what happens with a service worker.
-  WebSecurityPolicy::registerURLSchemeAsCORSEnabled(extension_scheme);
-
   // Resources should bypass Content Security Policy checks when included in
   // protected resources. TODO(kalman): What are "protected resources"?
   WebSecurityPolicy::registerURLSchemeAsBypassingContentSecurityPolicy(
       extension_scheme);
 
   // Extension resources are HTTP-like and safe to expose to the fetch API. The
   // rules for the fetch API are consistent with XHR.
   WebSecurityPolicy::registerURLSchemeAsSupportingFetchAPI(extension_scheme);
 
   // Extension resources, when loaded as the top-level document, should bypass
@@ skipping 1182 matching lines @@
   // The "guestViewDeny" module must always be loaded last. It registers
   // error-providing custom elements for the GuestView types that are not
   // available, and thus all of those types must have been checked and loaded
   // (or not loaded) beforehand.
   if (context_type == Feature::BLESSED_EXTENSION_CONTEXT) {
     module_system->Require("guestViewDeny");
   }
 }
 
 }  // namespace extensions