Added check to prevent extensions from injecting scrips into other extensions

chrome/common/extensions/extension.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/extensions/extension.h"
 
 #include <ostream>
 
 #include "base/base64.h"
 #include "base/basictypes.h"
@@ skipping 3557 matching lines @@
   if (browser_action())
     ++num_surfaces;
 
   if (is_app())
     ++num_surfaces;
 
   return num_surfaces > 1;
 }
 
 bool Extension::CanExecuteScriptOnPage(const GURL& page_url,
+                                       const GURL& top_frame_url,
                                        int tab_id,
                                        const UserScript* script,
                                        std::string* error) const {
   base::AutoLock auto_lock(runtime_data_lock_);
   // The gallery is special-cased as a restricted URL for scripting to prevent
   // access to special JS bindings we expose to the gallery (and avoid things
   // like extensions removing the "report abuse" link).
   // TODO(erikkay): This seems like the wrong test.  Shouldn't we we testing
   // against the store app extent?
   GURL store_url(extension_urls::GetWebstoreLaunchURL());
   if ((page_url.host() == store_url.host()) &&
       !CanExecuteScriptEverywhere() &&
       !CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kAllowScriptingGallery)) {
     if (error)
       *error = errors::kCannotScriptGallery;
     return false;
   }
 
   if (page_url.SchemeIs(chrome::kChromeUIScheme) &&
       !CanExecuteScriptEverywhere())
     return false;
 
+  if (top_frame_url.SchemeIs(chrome::kExtensionScheme) &&
+      top_frame_url.GetOrigin() !=
+          GetBaseURLFromExtensionId(id()).GetOrigin() &&
+      !CanExecuteScriptEverywhere())
+    return false;
+
   // If a tab ID is specified, try the tab-specific permissions.
   if (tab_id >= 0) {
     scoped_refptr<const PermissionSet> tab_permissions =
         runtime_data_.GetTabSpecificPermissions(tab_id);
     if (tab_permissions.get() &&
         tab_permissions->explicit_hosts().MatchesSecurityOrigin(page_url)) {
       return true;
     }
   }
 
@@ skipping 315 matching lines @@
 
 UpdatedExtensionPermissionsInfo::UpdatedExtensionPermissionsInfo(
     const Extension* extension,
     const PermissionSet* permissions,
     Reason reason)
     : reason(reason),
       extension(extension),
       permissions(permissions) {}
 
 }   // namespace extensions