Make sure that a given app/extension requests only its own resources.

chrome/browser/extensions/api/api_resource.h

Index: chrome/browser/extensions/api/api_resource.h
diff --git a/chrome/browser/extensions/api/api_resource.h b/chrome/browser/extensions/api/api_resource.h
index 86b9180d466565c5f0d8b371fc0459041f12d594..1a38cceb1a680d0c7318ffb2a94a726a4b762467 100644
--- a/chrome/browser/extensions/api/api_resource.h
+++ b/chrome/browser/extensions/api/api_resource.h
@@ -7,6 +7,7 @@
 
 #include "base/basictypes.h"
 #include "base/memory/ref_counted.h"
+#include "chrome/common/extensions/extension.h"
 
 namespace extensions {
 
@@ -19,12 +20,25 @@ class ApiResource {
  public:
   virtual ~ApiResource();
 
+  const std::string& owner_extension_id() const {
+    return owner_extension_id_;
+  }
+
  protected:
-  ApiResource(ApiResourceEventNotifier* event_notifier);
+  ApiResource(const std::string& owner_extension_id,
+              ApiResourceEventNotifier* event_notifier);
 
   ApiResourceEventNotifier* event_notifier() const;
 
  private:
+  // The extension that owns this resource. This could be derived from
+  // event_notifier, but that's a little too cute; to make future code
+  // maintenance easier, we'll require callers to explicitly specify the owner,
+  // and for now we'll assert that the owner implied by the event_notifier is
+  // consistent with the explicit one.
+  const std::string& owner_extension_id_;
+
+  // The object that lets this resource report events to the owner application.
   scoped_refptr<ApiResourceEventNotifier> event_notifier_;
 
   DISALLOW_COPY_AND_ASSIGN(ApiResource);