Index: chrome/renderer/chrome_content_renderer_client.cc |
diff --git a/chrome/renderer/chrome_content_renderer_client.cc b/chrome/renderer/chrome_content_renderer_client.cc |
index e380f31246295319eefdaaa9928e53025356236c..87380542c2470f50181258357cc8539f3452de0f 100644 |
--- a/chrome/renderer/chrome_content_renderer_client.cc |
+++ b/chrome/renderer/chrome_content_renderer_client.cc |
@@ -231,6 +231,14 @@ void ChromeContentRendererClient::RenderThreadStarted() { |
// chrome-extension: resources should be allowed to receive CORS requests. |
WebSecurityPolicy::registerURLSchemeAsCORSEnabled(extension_scheme); |
+ |
+ WebString extension_resource_scheme( |
+ ASCIIToUTF16(chrome::kExtensionResourceScheme)); |
+ WebSecurityPolicy::registerURLSchemeAsSecure(extension_resource_scheme); |
+ |
+ // chrome-extension-resource: resources should be allowed to receive CORS |
+ // requests. |
+ WebSecurityPolicy::registerURLSchemeAsCORSEnabled(extension_resource_scheme); |
} |
void ChromeContentRendererClient::RenderViewCreated( |
@@ -744,9 +752,8 @@ bool ChromeContentRendererClient::ShouldFork(WebFrame* frame, |
bool ChromeContentRendererClient::WillSendRequest(WebKit::WebFrame* frame, |
const GURL& url, |
GURL* new_url) { |
- // If the request is for an extension resource, check whether it should be |
- // allowed. If not allowed, we reset the URL to something invalid to prevent |
- // the request and cause an error. |
+ // Check whether the request should be allowed. If not allowed, we reset the |
+ // URL to something invalid to prevent the request and cause an error. |
if (url.SchemeIs(chrome::kExtensionScheme) && |
!ExtensionResourceRequestPolicy::CanRequestResource( |
url, |
@@ -754,6 +761,15 @@ bool ChromeContentRendererClient::WillSendRequest(WebKit::WebFrame* frame, |
extension_dispatcher_->extensions())) { |
*new_url = GURL("chrome-extension://invalid/"); |
return true; |
+ |
+ } |
+ |
+ if (url.SchemeIs(chrome::kExtensionResourceScheme) && |
+ !ExtensionResourceRequestPolicy::CanRequestExtensionResourceScheme( |
+ url, |
+ frame)) { |
+ *new_url = GURL("chrome-extension-resource://invalid/"); |
+ return true; |
} |
return false; |