Fix extension resource access permissions (issue #1719)

cef.gyp

@@ -1326,8 +1326,14 @@
         '<(DEPTH)/chrome/renderer/pepper/chrome_pdf_print_client.cc',
         '<(DEPTH)/chrome/renderer/pepper/chrome_pdf_print_client.h',
         # Include sources for extensions support.
+        '<(DEPTH)/chrome/common/extensions/chrome_manifest_url_handlers.cc',
+        '<(DEPTH)/chrome/common/extensions/chrome_manifest_url_handlers.h',
         '<(DEPTH)/chrome/common/pepper_permission_util.cc',
         '<(DEPTH)/chrome/common/pepper_permission_util.h',
+        '<(DEPTH)/chrome/common/url_constants.cc',
+        '<(DEPTH)/chrome/common/url_constants.h',
+        '<(DEPTH)/chrome/renderer/extensions/resource_request_policy.cc',
+        '<(DEPTH)/chrome/renderer/extensions/resource_request_policy.h',
         '<(DEPTH)/extensions/shell/browser/shell_display_info_provider.cc',
         '<(DEPTH)/extensions/shell/browser/shell_display_info_provider.h',
         '<(DEPTH)/extensions/shell/browser/shell_web_contents_modal_dialog_manager.cc',

libcef/common/scheme_registration.cc

@@ -15,8 +15,10 @@ void AddInternalSchemes(std::vector<std::string>* standard_schemes,
                         std::vector<std::string>* savable_schemes) {
   // chrome: and chrome-devtools: schemes are registered in
   // RenderThreadImpl::RegisterSchemes().
+  // Access restrictions for chrome-extension: and chrome-extension-resource:
+  // schemes will be applied in CefContentRendererClient::WillSendRequest().
   static CefContentClient::SchemeInfo schemes[] = {
-    { extensions::kExtensionScheme,         true,  true,  false, true  },
+    { extensions::kExtensionScheme,         true,  true,  false, false },
     { extensions::kExtensionResourceScheme, true,  true,  false, false },
   };
 

libcef/renderer/content_renderer_client.cc

@@ -35,8 +35,10 @@
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/pepper_permission_util.h"
+#include "chrome/common/url_constants.h"
 #include "chrome/grit/generated_resources.h"
 #include "chrome/renderer/content_settings_observer.h"
+#include "chrome/renderer/extensions/resource_request_policy.h"
 #include "chrome/renderer/loadtimes_extension_bindings.h"
 #include "chrome/renderer/pepper/chrome_pdf_print_client.h"
 #include "chrome/renderer/spellchecker/spellcheck.h"
@@ -57,6 +59,7 @@
 #include "content/public/renderer/render_view.h"
 #include "content/public/renderer/render_view_visitor.h"
 #include "content/renderer/render_frame_impl.h"
+#include "extensions/common/constants.h"
 #include "extensions/renderer/dispatcher.h"
 #include "extensions/renderer/dispatcher_delegate.h"
 #include "extensions/renderer/extension_frame_helper.h"
@@ -418,6 +421,9 @@ void CefContentRendererClient::RenderThreadStarted() {
     guest_view_container_dispatcher_.reset(
         new extensions::ExtensionsGuestViewContainerDispatcher());
     thread->AddObserver(guest_view_container_dispatcher_.get());
+
+    resource_request_policy_.reset(
+      new extensions::ResourceRequestPolicy(extension_dispatcher_.get()));
   }
 
   // Notify the render process handler.
@@ -559,6 +565,33 @@ bool CefContentRendererClient::HandleNavigation(
   return false;
 }
 
+bool CefContentRendererClient::WillSendRequest(
+    blink::WebFrame* frame,
+    ui::PageTransition transition_type,
+    const GURL& url,
+    const GURL& first_party_for_cookies,
+    GURL* new_url) {
+  if (extensions::ExtensionsEnabled()) {
+    // Check whether the request should be allowed. If not allowed, we reset the
+    // URL to something invalid to prevent the request and cause an error.
+    if (url.SchemeIs(extensions::kExtensionScheme) &&
+        !resource_request_policy_->CanRequestResource(url, frame,
+                                                      transition_type)) {
+      *new_url = GURL(chrome::kExtensionInvalidRequestURL);
+      return true;
+    }
+
+    if (url.SchemeIs(extensions::kExtensionResourceScheme) &&
+        !resource_request_policy_->CanRequestExtensionResourceScheme(url,
+                                                                     frame)) {
+      *new_url = GURL(chrome::kExtensionResourceInvalidRequestURL);
+      return true;
+    }
+  }
+
+  return false;
+}
+
 content::BrowserPluginDelegate*
 CefContentRendererClient::CreateBrowserPluginDelegate(
     content::RenderFrame* render_frame,

libcef/renderer/content_renderer_client.h

@@ -26,6 +26,7 @@ class DispatcherDelegate;
 class ExtensionsClient;
 class ExtensionsGuestViewContainerDispatcher;
 class ExtensionsRendererClient;
+class ResourceRequestPolicy;
 }
 
 namespace web_cache {
@@ -96,6 +97,11 @@ class CefContentRendererClient : public content::ContentRendererClient,
                         blink::WebNavigationType type,
                         blink::WebNavigationPolicy default_policy,
                         bool is_redirect) override;
+  bool WillSendRequest(blink::WebFrame* frame,
+                       ui::PageTransition transition_type,
+                       const GURL& url,
+                       const GURL& first_party_for_cookies,
+                       GURL* new_url) override;
   content::BrowserPluginDelegate* CreateBrowserPluginDelegate(
       content::RenderFrame* render_frame,
       const std::string& mime_type,
@@ -142,6 +148,7 @@ class CefContentRendererClient : public content::ContentRendererClient,
   scoped_ptr<extensions::Dispatcher> extension_dispatcher_;
   scoped_ptr<extensions::ExtensionsGuestViewContainerDispatcher>
       guest_view_container_dispatcher_;
+  scoped_ptr<extensions::ResourceRequestPolicy> resource_request_policy_;
 
   int devtools_agent_count_;
   int uncaught_exception_stack_size_;