Make sure that a given app/extension requests only its own resources.

chrome/browser/extensions/api/api_resource_manager.h

Index: chrome/browser/extensions/api/api_resource_manager.h
diff --git a/chrome/browser/extensions/api/api_resource_manager.h b/chrome/browser/extensions/api/api_resource_manager.h
index ded4dd50d10ac2d8bb6721464fe6b5466f90d34f..212d1e923dbfd2c095cc126becd2a97661ecc2b5 100644
--- a/chrome/browser/extensions/api/api_resource_manager.h
+++ b/chrome/browser/extensions/api/api_resource_manager.h
@@ -51,24 +51,32 @@ class ApiResourceManager : public ProfileKeyedService,
     return 0;
   }
 
-  void Remove(int api_resource_id) {
+  void Remove(const std::string& extension_id, int api_resource_id) {
     DCHECK(BrowserThread::CurrentlyOn(thread_id_));
-    api_resource_map_->erase(api_resource_id);
+    if (GetOwnedResource(extension_id, api_resource_id) != NULL) {
+      api_resource_map_->erase(api_resource_id);
+    }
   }
 
-  T* Get(int api_resource_id) {
+  T* Get(const std::string& extension_id, int api_resource_id) {
     DCHECK(BrowserThread::CurrentlyOn(thread_id_));
-    linked_ptr<T> ptr = (*api_resource_map_)[api_resource_id];
-    return ptr.get();
+    return GetOwnedResource(extension_id, api_resource_id);
   }
 
  private:
-  // TODO(miket): consider partitioning the ID space by extension ID to make it
-  // harder for extensions to peek into each others' resources.
   int GenerateId() {
     return next_id_++;
   }
 
+  T* GetOwnedResource(const std::string& extension_id,
+                      int api_resource_id) {
+    linked_ptr<T> ptr = (*api_resource_map_)[api_resource_id];
+    T* resource = ptr.get();
+    if (resource && extension_id == resource->owner_extension_id())
+      return resource;
+    return NULL;
+  }
+
   int next_id_;
   BrowserThread::ID thread_id_;