Protect the entire webstore origin, not just the webstore path, with XFO. Follow-up to crrev.com/1…

chrome/browser/renderer_host/chrome_resource_dispatcher_host_delegate.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/renderer_host/chrome_resource_dispatcher_host_delegate.h"
 
 #include <string>
 
 #include "base/base64.h"
 #include "base/logging.h"
@@ skipping 339 matching lines @@
 #if defined(ENABLE_ONE_CLICK_SIGNIN)
   // See if the response contains the Google-Accounts-SignIn header.  If so,
   // then the user has just finished signing in, and the server is allowing the
   // browser to suggest connecting the user's profile to the account.
   OneClickSigninHelper::ShowInfoBarIfPossible(request, info->GetChildID(),
                                               info->GetRouteID());
 #endif
 
   // Build in additional protection for the chrome web store origin.
   GURL webstore_url(extension_urls::GetWebstoreLaunchURL());
-  if (request->url().DomainIs(webstore_url.host().c_str()) &&
-      StartsWithASCII(request->url().path(), webstore_url.path(), false)) {
+  if (request->url().DomainIs(webstore_url.host().c_str())) {
     net::HttpResponseHeaders* response_headers = request->response_headers();
     if (!response_headers->HasHeaderValue("x-frame-options", "deny") &&
         !response_headers->HasHeaderValue("x-frame-options", "sameorigin")) {
       response_headers->RemoveHeader("x-frame-options");
       response_headers->AddHeader("x-frame-options: sameorigin");
     }
   }
 
   ProfileIOData* io_data = ProfileIOData::FromResourceContext(resource_context);
   if (io_data->resource_prefetch_predictor_observer())
@@ skipping 86 matching lines @@
   if (base::Base64Encode(serialized, &hashed)) {
     // If successful, swap the header value with the new one.
     // Note that the list of IDs and the header could be temporarily out of sync
     // if IDs are added as the header is recreated. The receiving servers are OK
     // with such descrepancies.
     variation_ids_header_ = hashed;
   } else {
     DVLOG(1) << "Failed to base64 encode Variation IDs value: " << serialized;
   }
 }