Extension resources should only load in contexts the extension has permission to access.

chrome/browser/extensions/extension_resource_request_policy_apitest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/logging.h"
 #include "chrome/browser/extensions/extension_apitest.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_tabstrip.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/test/base/ui_test_utils.h"
@@ skipping 36 matching lines @@
   // A web host that has permission.
   ui_test_utils::NavigateToURL(
       browser(), web_resource.ReplaceComponents(make_host_a_com));
   std::string result;
   ASSERT_TRUE(content::ExecuteJavaScriptAndExtractString(
     chrome::GetActiveWebContents(browser())->GetRenderViewHost(), L"",
       L"window.domAutomationController.send(document.title)",
     &result));
   EXPECT_EQ(result, "Loaded");
 
+  // A web host that does not have permission.
+  ui_test_utils::NavigateToURL(
+      browser(), web_resource.ReplaceComponents(make_host_b_com));
+  ASSERT_TRUE(content::ExecuteJavaScriptAndExtractString(
+    chrome::GetActiveWebContents(browser())->GetRenderViewHost(), L"",
+      L"window.domAutomationController.send(document.title)",
+    &result));
+  EXPECT_EQ(result, "Image failed to load");
+
   // A web host that loads a non-existent extension.
   GURL non_existent_extension(
       test_server()->GetURL(
           "files/extensions/api_test/extension_resource_request_policy/"
           "non_existent_extension.html"));
   ui_test_utils::NavigateToURL(browser(), non_existent_extension);
   ASSERT_TRUE(content::ExecuteJavaScriptAndExtractString(
     chrome::GetActiveWebContents(browser())->GetRenderViewHost(), L"",
       L"window.domAutomationController.send(document.title)",
     &result));
@@ skipping 154 matching lines @@
 
 #if defined(OS_MACOSX)
 #define MAYBE_ExtensionAccessibleResources FLAKY_ExtensionAccessibleResources
 #else
 #define MAYBE_ExtensionAccessibleResources ExtensionAccessibleResources
 #endif
 IN_PROC_BROWSER_TEST_F(ExtensionResourceRequestPolicyTest,
                        MAYBE_ExtensionAccessibleResources) {
   ASSERT_TRUE(RunExtensionSubtest("accessible_cer", "main.html")) << message_;
 }