Enabled CORS for chrome://resources.

content/browser/webui/shared_resources_data_source.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/webui/shared_resources_data_source.h"
 
 #include "base/logging.h"
 #include "base/memory/ref_counted_memory.h"
 #include "base/strings/string_util.h"
 #include "base/threading/thread_restrictions.h"
@@ skipping 71 matching lines @@
 std::string SharedResourcesDataSource::GetMimeType(
     const std::string& path) const {
   // Requests should not block on the disk!  On POSIX this goes to disk.
   // http://code.google.com/p/chromium/issues/detail?id=59849
 
   base::ThreadRestrictions::ScopedAllowIO allow_io;
   std::string mime_type;
   net::GetMimeTypeFromFile(base::FilePath().AppendASCII(path), &mime_type);
   return mime_type;
 }
+
+std::string
+SharedResourcesDataSource::GetAccessControlAllowOriginForOrigin(
+    const std::string& origin) const {
+  std::string allowed_origin_prefix = content::kChromeUIScheme;

[Charlie Reis, 2014/10/06 19:43:20]

nit: Let's put a comment here saying that we're intentionally echoing chrome://
origins in the CORS header, and why.  (That will help future people reading this
code.)

[dzhioev (left Google), 2014/10/08 18:41:56]

Done.

+  allowed_origin_prefix += "://";
+  if (origin.find(allowed_origin_prefix) != 0)
+    return "none";
+  return origin;
+}