Extensions: run "custom bindings" v8-extensions in content scripts.

chrome/renderer/extensions/custom_bindings_util.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/extensions/custom_bindings_util.h"
 
 #include <map>
 
 #include "base/logging.h"
 #include "base/string_util.h"
+#include "chrome/common/extensions/api/extension_api.h"
 #include "chrome/common/extensions/extension.h"
 #include "chrome/renderer/extensions/chrome_v8_extension.h"
 #include "chrome/renderer/extensions/chrome_private_custom_bindings.h"
 #include "chrome/renderer/extensions/context_menus_custom_bindings.h"
 #include "chrome/renderer/extensions/experimental.socket_custom_bindings.h"
 #include "chrome/renderer/extensions/extension_custom_bindings.h"
 #include "chrome/renderer/extensions/extension_dispatcher.h"
 #include "chrome/renderer/extensions/file_browser_handler_custom_bindings.h"
 #include "chrome/renderer/extensions/file_browser_private_custom_bindings.h"
 #include "chrome/renderer/extensions/page_actions_custom_bindings.h"
@@ skipping 116 matching lines @@
       next_to_upper = false;
     } else {
       camelcase.push_back(*it);
     }
   }
 
   return camelcase;
 }
 
 bool AllowAPIInjection(const std::string& api_name,
-                       const Extension& extension) {
+                       const Extension& extension,
+                       bool is_content_script) {
   CHECK(api_name != "");
 
   // As in ExtensionAPI::GetSchemasForExtension, we need to allow any bindings
   // for an API that the extension *might* have permission to use.
-  return extension.required_permission_set()->HasAnyAccessToAPI(api_name) ||
-         extension.optional_permission_set()->HasAnyAccessToAPI(api_name);
+  bool allowed =
+      extension.required_permission_set()->HasAnyAccessToAPI(api_name) ||
+      extension.optional_permission_set()->HasAnyAccessToAPI(api_name);
+
+  if (allowed && is_content_script)
+    allowed = !ExtensionAPI::GetInstance()->IsWholeAPIPrivileged(api_name);
+
+  return allowed;
 }
 
 }  // namespace custom_bindings_util
 
 }  // namespace extensions