Enabled CORS for chrome://resources.

content/public/browser/url_data_source.h

Index: content/public/browser/url_data_source.h
diff --git a/content/public/browser/url_data_source.h b/content/public/browser/url_data_source.h
index 33c185b63b87b5b8670f19f0590caad81eceefef..9230360721f4e8481dfbcd9b384eab6953710b3c 100644
--- a/content/public/browser/url_data_source.h
+++ b/content/public/browser/url_data_source.h
@@ -119,6 +119,15 @@ class CONTENT_EXPORT URLDataSource {
   // is for chrome-devtools.
   virtual bool ShouldServeMimeTypeAsContentTypeHeader() const;
 
+  // This method is called when the request contains "Origin:" header. The value
+  // of the header is passed in |origin| parameter. If the returned value is not
+  // empty, it is used as a value for "Access-Control-Allow-Origin:" response
+  // header, otherwise the header is not set. This method should return either
+  // |origin|, or "*", or "none", or empty string.
+  // Default implementation returns an empty string.
+  virtual std::string GetAccessControlAllowOriginForOrigin(

[Charlie Reis, 2014/10/06 19:43:20]

This looks like it is only used within content/, so it should not be part of the
public API.

See http://www.chromium.org/developers/content-module/content-api:
"only expose methods in the public API that embedders need. If a method is only
used by other code in content, it belongs in foo_impl.h and not foo.h."

[dzhioev (left Google), 2014/10/08 18:41:38]

We can't override this method in SharedResourceDataSource if it is not a part of
public API. Plus I don't see how this method differs from other customization
methods (GetContentSecurityPolicyObjectSrc or ShouldDenyXFrameOptions). The fact
that the only URLDataSource overriding this method lives in content doesn't mean
that other data sources will not override it in future.
 

[Charlie Reis, 2014/10/08 20:46:24]

It would work if there were an impl class that SharedResourceDataSource
inherited from, which the (confusingly named) URLDataSourceImpl could return
from its source() method.

I see that it's a bit awkward in this case due to how URLDataSourceImpl works,
but I'd like John to weigh in on that vs. the Content API rule.
We tend to not expose things until they're needed.  Both
GetContentSecurityPolicyObjectSrc and ShouldDenyXFrameOptions are used in
chrome/.

+      const std::string& origin) const;
+
   // Called to inform the source that StartDataRequest() will be called soon.
   // Gives the source an opportunity to rewrite |path| to incorporate extra
   // information from the URLRequest prior to serving.