chrome-search: should not be display-isolated

chrome/common/url_constants.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Contains constants for known URLs and portions thereof.
 
 #ifndef CHROME_COMMON_URL_CONSTANTS_H_
 #define CHROME_COMMON_URL_CONSTANTS_H_
 
 #include "build/build_config.h"
@@ skipping 393 matching lines @@
 extern const char* const kChromeDebugURLs[];
 extern const int kNumberOfChromeDebugURLs;
 
 // Canonical schemes you can use as input to GURL.SchemeIs().
 extern const char kExtensionResourceScheme[];
 
 // The chrome-search: scheme is served by the same backend as chrome:.  However,
 // only specific URLDataSources are enabled to serve requests via the
 // chrome-search: scheme.  See |InstantIOContext::ShouldServiceRequest| and its
 // callers for details.  Note that WebUIBindings should never be granted to
-// chrome-search: pages.
+// chrome-search: pages.  chrome-search: pages are displayable but not readable
+// by external search providers (that are rendered by Instant renderer
+// processes), and neither displayable nor readable by normal (non-Instant) web
+// pages.  To summarize, a non-Instant process, when trying to access
+// 'chrome-search://something', will bump up against the following:
+//
+//  1. Renderer: The display-isolated check in WebKit will deny the request,
+//  2. Browser: Assuming they got by #1, the scheme checks in
+//     URLDataSource::ShouldServiceRequest will deny the request,
+//  3. Browser: for specific sub-classes of URLDataSource, like ThemeSource
+//     there are additional Instant-PID checks that make sure the request is
+//     coming from a blessed Instant process, and deny the request.
 extern const char kChromeSearchScheme[];
 
 // The local omnibox host and pages under chrome-search.
 extern const char kChromeSearchLocalOmniboxPopupHost[];
 extern const char kChromeSearchLocalOmniboxPopupURL[];
 
 #if defined(OS_CHROMEOS)
 extern const char kCrosScheme[];
 extern const char kDriveScheme[];
 
 // "Learn more" URL for the Cloud Print section under Options.
 extern const char kCloudPrintLearnMoreURL[];
 #endif
 
 // Parameters that get appended to force SafeSearch.
 extern const char kSafeSearchSafeParameter[];
 extern const char kSafeSearchSsuiParameter[];
 
 // The URL for the "Learn more" link in the media access infobar.
 extern const char kMediaAccessLearnMoreUrl[];
 
 }  // namespace chrome
 
 #endif  // CHROME_COMMON_URL_CONSTANTS_H_