Webview should only allow resources loading from the extension that embedded it.
commit1dc4af7b5a6e56244f2755f7ece6039ec3e6cc41
authorlfg <lfg@chromium.org>
Tue, 31 Mar 2015 23:04:26 +0000 (31 16:04 -0700)
committerCommit bot <commit-bot@chromium.org>
Tue, 31 Mar 2015 23:04:56 +0000 (31 23:04 +0000)
treefafef44a41789379f14b4395f99cff8b81330e82
parente2b1f1b77d410afd44d4d65f67710fef216f0c78
Webview should only allow resources loading from the extension that embedded it.

This fixes an issue where Webview would allow cross renderer resource loads without checking if the URL referenced the same App that embedded the Webview.

BUG=470890

Review URL: https://codereview.chromium.org/1030323004

Cr-Commit-Position: refs/heads/master@{#323139}
chrome/browser/plugins/plugin_info_message_filter.cc
chrome/common/extensions/manifest_tests/extension_manifests_webview_accessible_resources_unittest.cc
chrome/test/data/extensions/manifest_tests/webview_accessible_resources_1.json
chrome/test/data/extensions/manifest_tests/webview_accessible_resources_2.json [copied from chrome/test/data/extensions/manifest_tests/webview_accessible_resources_1.json with 89% similarity]
extensions/browser/url_request_util.cc
extensions/common/manifest_handlers/webview_info.cc
extensions/common/manifest_handlers/webview_info.h