Enabled CORS for chrome://resources.

content/browser/webui/shared_resources_data_source.cc

Index: content/browser/webui/shared_resources_data_source.cc
diff --git a/content/browser/webui/shared_resources_data_source.cc b/content/browser/webui/shared_resources_data_source.cc
index 09711d98aa3dd0fe74f5f44afb92efaabc697861..2e76c043cc2797c81e48aca1680ba4e27a629bbb 100644
--- a/content/browser/webui/shared_resources_data_source.cc
+++ b/content/browser/webui/shared_resources_data_source.cc
@@ -89,3 +89,13 @@ std::string SharedResourcesDataSource::GetMimeType(
   net::GetMimeTypeFromFile(base::FilePath().AppendASCII(path), &mime_type);
   return mime_type;
 }
+
+std::string
+SharedResourcesDataSource::GetAccessControlAllowOriginForOrigin(
+    const std::string& origin) const {
+  std::string allowed_origin_prefix = content::kChromeUIScheme;

[Charlie Reis, 2014/10/06 19:43:20]

nit: Let's put a comment here saying that we're intentionally echoing chrome://
origins in the CORS header, and why.  (That will help future people reading this
code.)

[dzhioev (left Google), 2014/10/08 18:41:56]

Done.

+  allowed_origin_prefix += "://";
+  if (origin.find(allowed_origin_prefix) != 0)
+    return "none";
+  return origin;
+}