Add sanbdoxed_pages to allow extension/app pages to be served in a sandboxed, unique origin

chrome/common/extensions/extension.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_COMMON_EXTENSIONS_EXTENSION_H_
 #define CHROME_COMMON_EXTENSIONS_EXTENSION_H_
 #pragma once
 
 #include <algorithm>
 #include <map>
@@ skipping 312 matching lines @@
   // NOTE: Static so that it can be used from multiple threads.
   static GURL GetResourceURL(const GURL& extension_url,
                              const std::string& relative_path);
   GURL GetResourceURL(const std::string& relative_path) const {
     return GetResourceURL(url(), relative_path);
   }
 
   // Returns true if the specified resource is web accessible.
   bool IsResourceWebAccessible(const std::string& relative_path) const;
 
+  // Returns true if the specified page is sandboxed (served in a unique
+  // origin).
+  bool IsSandboxedPage(const std::string& relative_path) const;
+
+  // Returns the Content Security Policy that the specified resource should be
+  // served with.
+  std::string GetResourceContentSecurityPolicy(const std::string& relative_path)
+      const;
+
   // Returns true when 'web_accessible_resources' are defined for the extension.
   bool HasWebAccessibleResources() const;
 
   // Returns an extension resource object. |relative_path| should be UTF8
   // encoded.
   ExtensionResource GetResource(const std::string& relative_path) const;
 
   // As above, but with |relative_path| following the file system's encoding.
   ExtensionResource GetResource(const FilePath& relative_path) const;
 
@@ skipping 280 matching lines @@
   const std::vector<webkit_glue::WebIntentServiceData>&
       intents_services() const {
     return intents_services_;
   }
 
   bool wants_file_access() const { return wants_file_access_; }
   int creation_flags() const { return creation_flags_; }
   bool from_webstore() const { return (creation_flags_ & FROM_WEBSTORE) != 0; }
   bool from_bookmark() const { return (creation_flags_ & FROM_BOOKMARK) != 0; }
 
-  const std::string& content_security_policy() const {
-    return content_security_policy_;
-  }
-
   // App-related.
   bool is_app() const {
     return is_packaged_app() || is_hosted_app() || is_platform_app();
   }
   bool is_platform_app() const;
   bool is_hosted_app() const;
   bool is_packaged_app() const;
   bool is_storage_isolated() const { return is_storage_isolated_; }
   const URLPatternSet& web_extent() const { return extent_; }
   const std::string& launch_local_path() const { return launch_local_path_; }
@@ skipping 88 matching lines @@
                           string16* error);
   bool LoadDescription(string16* error);
   bool LoadManifestVersion(string16* error);
   bool LoadHomepageURL(string16* error);
   bool LoadUpdateURL(string16* error);
   bool LoadIcons(string16* error);
   bool LoadCommands(string16* error);
   bool LoadPlugins(string16* error);
   bool LoadNaClModules(string16* error);
   bool LoadWebAccessibleResources(string16* error);
+  bool LoadSandboxedPages(string16* error);
   bool CheckRequirements(string16* error);
   bool LoadDefaultLocale(string16* error);
   bool LoadOfflineEnabled(string16* error);
   bool LoadOptionsPage(string16* error);
   bool LoadBackgroundScripts(string16* error);
   bool LoadBackgroundPage(const ExtensionAPIPermissionSet& api_permissions,
                           string16* error);
   bool LoadBackgroundPersistent(
       const ExtensionAPIPermissionSet& api_permissions,
       string16* error);
@@ skipping 188 matching lines @@
   std::vector<InputComponentInfo> input_components_;
 
   // Optional list of commands (keyboard shortcuts).
   scoped_ptr<extensions::Command> browser_action_command_;
   scoped_ptr<extensions::Command> page_action_command_;
   extensions::CommandMap named_commands_;
 
   // Optional list of web accessible extension resources.
   base::hash_set<std::string> web_accessible_resources_;
 
+  // Optional list of extension pages that are sandboxed (served from a unique
+  // origin with a different Content Security Policy).
+  base::hash_set<std::string> sandboxed_pages_;
+
+  // Content Security Policy that should be used to enforce the sandbox used
+  // by sandboxed pages (guaranteed to have the "sandbox" directive without the
+  // "allow-same-origin" token).
+  std::string sandboxed_pages_content_security_policy_;
+
   // Optional URL to a master page of which a single instance should be always
   // loaded in the background.
   GURL background_url_;
 
   // Optional list of scripts to use to generate a background page. If this is
   // present, background_url_ will be empty and generated by GetBackgroundURL().
   std::vector<std::string> background_scripts_;
 
   // True if the background page should stay loaded forever; false if it should
   // load on-demand (when it needs to handle an event). Defaults to true.
@@ skipping 154 matching lines @@
 
   UpdatedExtensionPermissionsInfo(
       const Extension* extension,
       const ExtensionPermissionSet* permissions,
       Reason reason);
 };
 
 } // namespace extensions
 
 #endif  // CHROME_COMMON_EXTENSIONS_EXTENSION_H_