Block 'ftp:' subresource requests from non-'ftp:' pages.

chrome/test/data/extensions/api_test/cross_origin_xhr/content_script/test.js

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Tab where the content script has been injected.
 var testTabId;
 
 chrome.test.getConfig(function(config) {
 
   function rewriteURL(url) {
@@ skipping 52 matching lines @@
       // TODO(asargent): Explicitly create SSL test server and enable the test.
       // function disallowedSSL() {
       //   doReq('https://a.com', false);
       // },
       function targetPageAlwaysAllowed() {
         // Even though localhost does not show up in the host permissions, we
         // can still make requests to it since it's the page that the content
         // script is injected into.
         doReq('http://localhost', true);
       },
-      function allowedFtpHostAllowed() {
-        doReq('ftp://127.0.0.1', true);
+      function allowedFtpHostDisllowed() {
+        doReq('ftp://127.0.0.1', false);
       },
       function disallowedFtpHostDisallowed() {
         // The host is the same as the current page, but the scheme differs.
         // The origin is not whitelisted, so the same origin policy must kick in
         // and block the request.
         doReq('ftp://localhost', false);
       }
     ]);
   });
 });