Altered the logic that determines when NaCl is enabled. Previously, we requi...

chrome/renderer/render_view.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/render_view.h"
 
 #include <algorithm>
 #include <string>
 #include <vector>
 
@@ skipping 3229 matching lines @@
   } else {
     FilePath internal_pdf_path;
     PathService::Get(chrome::FILE_PDF_PLUGIN, &internal_pdf_path);
     if (file_path == internal_pdf_path) {
       in_process_plugin = true;
       use_pepper_host = true;
     }
   }
 
   // Check for Native Client modules.
-  if (CommandLine::ForCurrentProcess()->HasSwitch(switches::kInternalNaCl)) {
-    if (mime_type == "application/x-nacl-srpc") {
+  if (mime_type == "application/x-nacl-srpc") {
+    // NaCl is only permitted when we're in an extension/application with the
+    // appropriate permission, or when explicitly enabled on the command line.
+
+    // TODO(cbiffle): need browser test for this before M7 (bug 45881)
+    GURL main_frame_url(webview()->mainFrame()->url());
+    const std::string &extension_id =
+        RenderThread::current()->GetExtensionIdByURL(main_frame_url);
+    bool in_ext = extension_id != "";
+    bool explicit_enable =
+        CommandLine::ForCurrentProcess()->HasSwitch(switches::kInternalNaCl);
+
+    if (in_ext) {
+      if (ExtensionProcessBindings::HasPermission(extension_id,
+              Extension::kNativeClientPermission)) {
+        in_process_plugin = true;
+        use_pepper_host = true;
+      } else {
+        // Disable NaCl for apps lacking the permission, even with the flag.
+        return NULL;
+      }
+    } else if (explicit_enable) {
       in_process_plugin = true;
       use_pepper_host = true;
     }
   }
 
   if (in_process_plugin) {
     if (use_pepper_host) {
       WebPluginDelegatePepper* pepper_plugin =
            WebPluginDelegatePepper::Create(file_path, mime_type, AsWeakPtr());
       if (!pepper_plugin)
@@ skipping 1953 matching lines @@
     // the origins of the two domains are different. This can be treated as a
     // top level navigation and routed back to the host.
     WebKit::WebFrame* opener = frame->opener();
     if (opener) {
       if (url.GetOrigin() != GURL(opener->url()).GetOrigin())
         return true;
     }
   }
   return false;
 }