Fix webview-accessible resource checks in AllowCrossRendererResourceLoadHelper

extensions/browser/url_request_util.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/browser/url_request_util.h"
 
 #include <string>
 
 #include "content/public/browser/resource_request_info.h"
 #include "content/public/common/browser_side_navigation_policy.h"
@@ skipping 134 matching lines @@
   return data && data->is_web_view();
 }
 
 bool AllowCrossRendererResourceLoadHelper(bool is_guest,
                                           const Extension* extension,
                                           const Extension* owner_extension,
                                           const std::string& partition_id,
                                           const std::string& resource_path,
                                           ui::PageTransition page_transition,
                                           bool* allowed) {
-  // |owner_extension == extension| needs to be checked because extension
-  // resources should only be accessible to WebViews owned by that extension.
-  if (is_guest && owner_extension == extension &&
-      WebviewInfo::IsResourceWebviewAccessible(extension, partition_id,
-                                               resource_path)) {
-    *allowed = true;
+  if (is_guest) {
+    // An extension's resources should only be accessible to WebViews owned by
+    // that extension.
+    if (owner_extension != extension) {

[alexmos, 2017/03/23 18:23:53]

Seems like the old check also allowed web-triggerable loads to any non-owner
extension.  Is there any case where a webview should be loading resources from
an app/extension that doesn't own it?  If we wanted to be conservative here, we
could also return false without setting *allowed for that case.  But this
stricter check doesn't break any tests either. :)

[lfg, 2017/03/23 18:49:40]

This is a bug I fixed in the past, but Paul reintroduced it here
https://codereview.chromium.org/1312653003 (PS5->PS6; shame on me for not
looking at the CL after l-g-t-m'ing it).

<webview> should only load resources specified in the manifest of the extension
that owns it.

+cc paulmeyer

+      *allowed = false;
+      return true;
+    }
+
+    *allowed = WebviewInfo::IsResourceWebviewAccessible(extension, partition_id,
+                                                        resource_path);
     return true;
   }
 
-  if (is_guest && !ui::PageTransitionIsWebTriggerable(page_transition)) {
-    *allowed = false;
-    return true;
-  }
-
   return false;
 }
 
 }  // namespace url_request_util
 }  // namespace extensions