Add sanbdoxed_pages to allow extension/app pages to be served in a sandboxed, unique origin

chrome/renderer/extensions/extension_dispatcher.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/extensions/extension_dispatcher.h"
 
 #include "base/callback.h"
 #include "base/command_line.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/string_piece.h"
@@ skipping 878 matching lines @@
   RenderThread::Get()->Send(new ExtensionHostMsg_UnloadAck(extension_id));
 }
 
 Feature::Context ExtensionDispatcher::ClassifyJavaScriptContext(
     const std::string& extension_id,
     int extension_group,
     const ExtensionURLInfo& url_info) {
   if (extension_group == EXTENSION_GROUP_CONTENT_SCRIPTS)
     return Feature::CONTENT_SCRIPT_CONTEXT;
 
+  // We have an explicit check for sandboxed pages first since:
+  // 1. Sandboxed pages run in the same process as regular extension pages, so
+  //    the extension is considered active.
+  // 2. ScriptContext creation (which triggers bindings injection) happens
+  //    before the SecurityContext is updated with the sandbox flags (after
+  //    reading the CSP header), so url_info.url().securityOrigin() is not
+  //    unique yet.
+  if (extensions_.IsSandboxedPage(url_info))
+    return Feature::WEB_PAGE_CONTEXT;
+
   if (IsExtensionActive(extension_id))
     return Feature::BLESSED_EXTENSION_CONTEXT;
 
   if (extensions_.ExtensionBindingsAllowed(url_info))
     return Feature::UNBLESSED_EXTENSION_CONTEXT;
 
   if (url_info.url().is_valid())
     return Feature::WEB_PAGE_CONTEXT;
 
   return Feature::UNSPECIFIED_CONTEXT;
@@ skipping 18 matching lines @@
       !context->extension()->HasAPIPermission(function_name)) {
     static const char kMessage[] =
         "You do not have permission to use '%s'. Be sure to declare"
         " in your manifest what permissions you need.";
     std::string error_msg = base::StringPrintf(kMessage, function_name.c_str());
     v8::ThrowException(
         v8::Exception::Error(v8::String::New(error_msg.c_str())));
     return false;
   }
 
-  if (!IsExtensionActive(context->extension()->id()) &&
-      ExtensionAPI::GetSharedInstance()->IsPrivileged(function_name)) {
+  if (ExtensionAPI::GetSharedInstance()->IsPrivileged(function_name) &&
+      context->context_type() != Feature::BLESSED_EXTENSION_CONTEXT) {
     static const char kMessage[] =
         "%s can only be used in an extension process.";
     std::string error_msg = base::StringPrintf(kMessage, function_name.c_str());
     v8::ThrowException(
         v8::Exception::Error(v8::String::New(error_msg.c_str())));
     return false;
   }
 
+  // We should never end up with sandboxed contexts trying to invoke extension

[Mihai Parparita -not on Chrome, 2012/06/05 23:39:06]

Adam also suggested checking at API invocation time that we're not in a
sandboxed page. I added a CHECK, since we should never be able to get here in
normal circumstances.

+  // APIs, they don't get extension bindings injected. If we end up here it
+  // means that a sandboxed page somehow managed to invoke an API anyway, so
+  // we should abort.
+  WebKit::WebFrame* frame = context->web_frame();
+  ExtensionURLInfo url_info(frame->document().securityOrigin(),
+      UserScriptSlave::GetDataSourceURLForFrame(frame));
+  CHECK(!extensions_.IsSandboxedPage(url_info));
+
   return true;
 }