Toro: Move ExtensionProtocolHandler to //extensions

This breaks Chrome dependencies in ExtensionProtocolHandler and moves //chrome/browser/extensions/extension_protocol.cc into //extensions/browser so it can be used in app_shell.

* Extract URLRequestResourceBundleJob to Chrome as it is used only to load component extension resources from Chrome's PAK files.
* Replace Profile::ProfileType usage with is_incognito to break the Profile dependency.
* Delegate out the decision to allow cross-renderer extension resource loads because this is primarily used for Chrome-specific extension features
* Eliminate chrome-extension-resource:// handling in app_shell (it allows sharing common extension data in the <chrome-install>/resources/extension/ directory, which app_shell doesn't need).

BUG=361373
TEST=browser_tests *Extension* and PlatformApp*, unit_tests ExtensionProtocol*, app_shell loads calculator
[email protected] for mechanical header file move/refactor across chrome/browser

Review URL: https://codereview.chromium.org/229733002

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@263198 0039d316-1c4b-4281-b951-d872f2087c98
diff --git a/apps/shell/DEPS b/apps/shell/DEPS
index 00a2196..82df3e3a 100644
--- a/apps/shell/DEPS
+++ b/apps/shell/DEPS
@@ -7,11 +7,14 @@
   "+apps/shell/common",
   "+apps/shell/test",
 
+  # Do not add dependencies on Chrome. Talk to OWNERS about how to refactor
+  # the code you need to a shared location.
+  "-chrome",
+
   # Real DEPS go in subdirectories, for example apps/shell/browser/DEPS.
   # Temporary exceptions for app_shell bring-up go here.
   # TODO(jamescook): Remove these. http://crbug.com/305404
-  "!chrome/browser/extensions/extension_protocols.h",
-  "!chrome/browser/extensions/extension_resource_protocols.h",
+  "!chrome/browser/chrome_notification_types.h",
   "!chrome/common/extensions/api/generated_api.h",
   "!chrome/common/extensions/api/generated_schemas.h",
   "!chrome/common/extensions/api/sockets/sockets_manifest_handler.h",
diff --git a/apps/shell/browser/shell_content_browser_client.cc b/apps/shell/browser/shell_content_browser_client.cc
index dfafc535..ca9db4e 100644
--- a/apps/shell/browser/shell_content_browser_client.cc
+++ b/apps/shell/browser/shell_content_browser_client.cc
@@ -8,8 +8,6 @@
 #include "apps/shell/browser/shell_browser_main_parts.h"
 #include "apps/shell/browser/shell_extension_system.h"
 #include "base/command_line.h"
-#include "chrome/browser/extensions/extension_protocols.h"
-#include "chrome/browser/extensions/extension_resource_protocols.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/site_instance.h"
@@ -17,6 +15,7 @@
 #include "content/public/common/url_constants.h"
 #include "content/shell/browser/shell_browser_context.h"
 #include "extensions/browser/extension_message_filter.h"
+#include "extensions/browser/extension_protocols.h"
 #include "extensions/browser/extension_registry.h"
 #include "extensions/browser/info_map.h"
 #include "extensions/browser/process_map.h"
@@ -79,16 +78,15 @@
     content::BrowserContext* content_browser_context,
     content::ProtocolHandlerMap* protocol_handlers,
     content::ProtocolHandlerScopedVector protocol_interceptors) {
-  // Handle chrome-extension: and chrome-extension-resource: requests.
+  // Handle only chrome-extension:// requests. app_shell does not support
+  // chrome-extension-resource:// requests (it does not store shared extension
+  // data in its installation directory).
   extensions::InfoMap* extension_info_map =
       browser_main_parts_->extension_system()->info_map();
   (*protocol_handlers)[extensions::kExtensionScheme] =
       linked_ptr<net::URLRequestJobFactory::ProtocolHandler>(
-          CreateExtensionProtocolHandler(Profile::REGULAR_PROFILE,
-                                         extension_info_map));
-  (*protocol_handlers)[extensions::kExtensionResourceScheme] =
-      linked_ptr<net::URLRequestJobFactory::ProtocolHandler>(
-          CreateExtensionResourceProtocolHandler());
+          extensions::CreateExtensionProtocolHandler(false /* is_incognito */,
+                                                     extension_info_map));
   // Let content::ShellBrowserContext handle the rest of the setup.
   return browser_main_parts_->browser_context()->CreateRequestContext(
       protocol_handlers, protocol_interceptors.Pass());
diff --git a/apps/shell/browser/shell_extensions_browser_client.cc b/apps/shell/browser/shell_extensions_browser_client.cc
index e64c137..395bc184 100644
--- a/apps/shell/browser/shell_extensions_browser_client.cc
+++ b/apps/shell/browser/shell_extensions_browser_client.cc
@@ -150,6 +150,25 @@
   return false;
 }
 
+net::URLRequestJob*
+ShellExtensionsBrowserClient::MaybeCreateResourceBundleRequestJob(
+    net::URLRequest* request,
+    net::NetworkDelegate* network_delegate,
+    const base::FilePath& directory_path,
+    const std::string& content_security_policy,
+    bool send_cors_header) {
+  return NULL;
+}
+
+bool ShellExtensionsBrowserClient::AllowCrossRendererResourceLoad(
+    net::URLRequest* request,
+    bool is_incognito,
+    const Extension* extension,
+    InfoMap* extension_info_map) {
+  // Note: This may need to change if app_shell supports webview.
+  return false;
+}
+
 PrefService* ShellExtensionsBrowserClient::GetPrefServiceForContext(
     BrowserContext* context) {
   return prefs_.get();
diff --git a/apps/shell/browser/shell_extensions_browser_client.h b/apps/shell/browser/shell_extensions_browser_client.h
index c2a2130d..245d46c 100644
--- a/apps/shell/browser/shell_extensions_browser_client.h
+++ b/apps/shell/browser/shell_extensions_browser_client.h
@@ -42,6 +42,17 @@
   virtual bool CanExtensionCrossIncognito(
       const extensions::Extension* extension,
       content::BrowserContext* context) const OVERRIDE;
+  virtual net::URLRequestJob* MaybeCreateResourceBundleRequestJob(
+      net::URLRequest* request,
+      net::NetworkDelegate* network_delegate,
+      const base::FilePath& directory_path,
+      const std::string& content_security_policy,
+      bool send_cors_header) OVERRIDE;
+  virtual bool AllowCrossRendererResourceLoad(net::URLRequest* request,
+                                              bool is_incognito,
+                                              const Extension* extension,
+                                              InfoMap* extension_info_map)
+      OVERRIDE;
   virtual PrefService* GetPrefServiceForContext(
       content::BrowserContext* context) OVERRIDE;
   virtual void GetEarlyExtensionPrefsObservers(
diff --git a/chrome/browser/chrome_browser_main.cc b/chrome/browser/chrome_browser_main.cc
index be8a435..4404b35 100644
--- a/chrome/browser/chrome_browser_main.cc
+++ b/chrome/browser/chrome_browser_main.cc
@@ -49,7 +49,6 @@
 #include "chrome/browser/component_updater/swiftshader_component_installer.h"
 #include "chrome/browser/component_updater/widevine_cdm_component_installer.h"
 #include "chrome/browser/defaults.h"
-#include "chrome/browser/extensions/extension_protocols.h"
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/extensions/startup_helper.h"
 #include "chrome/browser/feedback/feedback_profile_observer.h"
@@ -124,6 +123,7 @@
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/main_function_params.h"
+#include "extensions/browser/extension_protocols.h"
 #include "extensions/browser/extension_system.h"
 #include "grit/app_locale_settings.h"
 #include "grit/browser_resources.h"
diff --git a/chrome/browser/extensions/chrome_extensions_browser_client.cc b/chrome/browser/extensions/chrome_extensions_browser_client.cc
index 65ebebe..2fe1e35 100644
--- a/chrome/browser/extensions/chrome_extensions_browser_client.cc
+++ b/chrome/browser/extensions/chrome_extensions_browser_client.cc
@@ -17,6 +17,7 @@
 #include "chrome/browser/extensions/chrome_extension_host_delegate.h"
 #include "chrome/browser/extensions/extension_system_factory.h"
 #include "chrome/browser/extensions/extension_util.h"
+#include "chrome/browser/extensions/url_request_util.h"
 #include "chrome/browser/external_protocol/external_protocol_handler.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/profiles/profile_manager.h"
@@ -112,6 +113,30 @@
       || util::CanCrossIncognito(extension, context);
 }
 
+net::URLRequestJob*
+ChromeExtensionsBrowserClient::MaybeCreateResourceBundleRequestJob(
+    net::URLRequest* request,
+    net::NetworkDelegate* network_delegate,
+    const base::FilePath& directory_path,
+    const std::string& content_security_policy,
+    bool send_cors_header) {
+  return url_request_util::MaybeCreateURLRequestResourceBundleJob(
+      request,
+      network_delegate,
+      directory_path,
+      content_security_policy,
+      send_cors_header);
+}
+
+bool ChromeExtensionsBrowserClient::AllowCrossRendererResourceLoad(
+    net::URLRequest* request,
+    bool is_incognito,
+    const Extension* extension,
+    InfoMap* extension_info_map) {
+  return url_request_util::AllowCrossRendererResourceLoad(
+      request, is_incognito, extension, extension_info_map);
+}
+
 PrefService* ChromeExtensionsBrowserClient::GetPrefServiceForContext(
     content::BrowserContext* context) {
   return static_cast<Profile*>(context)->GetPrefs();
diff --git a/chrome/browser/extensions/chrome_extensions_browser_client.h b/chrome/browser/extensions/chrome_extensions_browser_client.h
index 80e8fbde..bc4f7e3 100644
--- a/chrome/browser/extensions/chrome_extensions_browser_client.h
+++ b/chrome/browser/extensions/chrome_extensions_browser_client.h
@@ -56,6 +56,17 @@
   virtual bool CanExtensionCrossIncognito(
       const extensions::Extension* extension,
       content::BrowserContext* context) const OVERRIDE;
+  virtual net::URLRequestJob* MaybeCreateResourceBundleRequestJob(
+      net::URLRequest* request,
+      net::NetworkDelegate* network_delegate,
+      const base::FilePath& directory_path,
+      const std::string& content_security_policy,
+      bool send_cors_header) OVERRIDE;
+  virtual bool AllowCrossRendererResourceLoad(net::URLRequest* request,
+                                              bool is_incognito,
+                                              const Extension* extension,
+                                              InfoMap* extension_info_map)
+      OVERRIDE;
   virtual PrefService* GetPrefServiceForContext(
       content::BrowserContext* context) OVERRIDE;
   virtual void GetEarlyExtensionPrefsObservers(
diff --git a/chrome/browser/extensions/extension_protocols.h b/chrome/browser/extensions/extension_protocols.h
deleted file mode 100644
index ffef9d1..0000000
--- a/chrome/browser/extensions/extension_protocols.h
+++ /dev/null
@@ -1,20 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CHROME_BROWSER_EXTENSIONS_EXTENSION_PROTOCOLS_H_
-#define CHROME_BROWSER_EXTENSIONS_EXTENSION_PROTOCOLS_H_
-
-#include "chrome/browser/profiles/profile.h"
-#include "net/url_request/url_request_job_factory.h"
-
-namespace extensions {
-class InfoMap;
-}
-
-// Creates the handlers for the chrome-extension:// scheme.
-net::URLRequestJobFactory::ProtocolHandler* CreateExtensionProtocolHandler(
-    Profile::ProfileType profile_type,
-    extensions::InfoMap* extension_info_map);
-
-#endif  // CHROME_BROWSER_EXTENSIONS_EXTENSION_PROTOCOLS_H_
diff --git a/chrome/browser/extensions/url_request_util.cc b/chrome/browser/extensions/url_request_util.cc
new file mode 100644
index 0000000..661b0330
--- /dev/null
+++ b/chrome/browser/extensions/url_request_util.cc
@@ -0,0 +1,243 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/extensions/url_request_util.h"
+
+#include <string>
+
+#include "base/files/file_path.h"
+#include "base/memory/weak_ptr.h"
+#include "base/path_service.h"
+#include "base/strings/string_number_conversions.h"
+#include "base/strings/string_util.h"
+#include "base/strings/stringprintf.h"
+#include "base/task_runner_util.h"
+#include "chrome/browser/extensions/extension_renderer_state.h"
+#include "chrome/browser/extensions/image_loader.h"
+#include "chrome/common/chrome_paths.h"
+#include "chrome/common/extensions/manifest_url_handler.h"
+#include "content/public/browser/browser_thread.h"
+#include "content/public/browser/resource_request_info.h"
+#include "extensions/browser/extension_protocols.h"
+#include "extensions/browser/info_map.h"
+#include "extensions/common/file_util.h"
+#include "extensions/common/manifest_handlers/icons_handler.h"
+#include "extensions/common/manifest_handlers/web_accessible_resources_info.h"
+#include "extensions/common/manifest_handlers/webview_info.h"
+#include "net/base/mime_util.h"
+#include "net/base/net_errors.h"
+#include "net/http/http_request_headers.h"
+#include "net/http/http_response_headers.h"
+#include "net/http/http_response_info.h"
+#include "net/url_request/url_request.h"
+#include "net/url_request/url_request_simple_job.h"
+#include "ui/base/resource/resource_bundle.h"
+
+using content::BrowserThread;
+
+namespace {
+
+// A request for an extension resource in a Chrome .pak file. These are used
+// by component extensions.
+class URLRequestResourceBundleJob : public net::URLRequestSimpleJob {
+ public:
+  URLRequestResourceBundleJob(net::URLRequest* request,
+                              net::NetworkDelegate* network_delegate,
+                              const base::FilePath& filename,
+                              int resource_id,
+                              const std::string& content_security_policy,
+                              bool send_cors_header)
+      : net::URLRequestSimpleJob(request, network_delegate),
+        filename_(filename),
+        resource_id_(resource_id),
+        weak_factory_(this) {
+    // Leave cache headers out of resource bundle requests.
+    response_info_.headers = extensions::BuildHttpHeaders(
+        content_security_policy, send_cors_header, base::Time());
+  }
+
+  // Overridden from URLRequestSimpleJob:
+  virtual int GetData(std::string* mime_type,
+                      std::string* charset,
+                      std::string* data,
+                      const net::CompletionCallback& callback) const OVERRIDE {
+    const ResourceBundle& rb = ResourceBundle::GetSharedInstance();
+    *data = rb.GetRawDataResource(resource_id_).as_string();
+
+    // Add the Content-Length header now that we know the resource length.
+    response_info_.headers->AddHeader(
+        base::StringPrintf("%s: %s",
+                           net::HttpRequestHeaders::kContentLength,
+                           base::UintToString(data->size()).c_str()));
+
+    std::string* read_mime_type = new std::string;
+    bool posted = base::PostTaskAndReplyWithResult(
+        BrowserThread::GetBlockingPool(),
+        FROM_HERE,
+        base::Bind(&net::GetMimeTypeFromFile,
+                   filename_,
+                   base::Unretained(read_mime_type)),
+        base::Bind(&URLRequestResourceBundleJob::OnMimeTypeRead,
+                   weak_factory_.GetWeakPtr(),
+                   mime_type,
+                   charset,
+                   data,
+                   base::Owned(read_mime_type),
+                   callback));
+    DCHECK(posted);
+
+    return net::ERR_IO_PENDING;
+  }
+
+  virtual void GetResponseInfo(net::HttpResponseInfo* info) OVERRIDE {
+    *info = response_info_;
+  }
+
+ private:
+  virtual ~URLRequestResourceBundleJob() {}
+
+  void OnMimeTypeRead(std::string* out_mime_type,
+                      std::string* charset,
+                      std::string* data,
+                      std::string* read_mime_type,
+                      const net::CompletionCallback& callback,
+                      bool read_result) {
+    *out_mime_type = *read_mime_type;
+    if (StartsWithASCII(*read_mime_type, "text/", false)) {
+      // All of our HTML files should be UTF-8 and for other resource types
+      // (like images), charset doesn't matter.
+      DCHECK(IsStringUTF8(*data));
+      *charset = "utf-8";
+    }
+    int result = read_result ? net::OK : net::ERR_INVALID_URL;
+    callback.Run(result);
+  }
+
+  // We need the filename of the resource to determine the mime type.
+  base::FilePath filename_;
+
+  // The resource bundle id to load.
+  int resource_id_;
+
+  net::HttpResponseInfo response_info_;
+
+  mutable base::WeakPtrFactory<URLRequestResourceBundleJob> weak_factory_;
+};
+
+}  // namespace
+
+namespace extensions {
+namespace url_request_util {
+
+bool AllowCrossRendererResourceLoad(net::URLRequest* request,
+                                    bool is_incognito,
+                                    const Extension* extension,
+                                    InfoMap* extension_info_map) {
+  const content::ResourceRequestInfo* info =
+      content::ResourceRequestInfo::ForRequest(request);
+
+  // Check workers so that importScripts works from extension workers.
+  if (extension_info_map->worker_process_map().Contains(request->url().host(),
+                                                        info->GetChildID())) {
+    return true;
+  }
+
+  // Extensions with webview: allow loading certain resources by guest renderers
+  // with privileged partition IDs as specified in the manifest file.
+  ExtensionRendererState* renderer_state =
+      ExtensionRendererState::GetInstance();
+  ExtensionRendererState::WebViewInfo webview_info;
+  bool is_guest = renderer_state->GetWebViewInfo(
+      info->GetChildID(), info->GetRouteID(), &webview_info);
+  std::string resource_path = request->url().path();
+  if (is_guest && WebviewInfo::IsResourceWebviewAccessible(
+                      extension, webview_info.partition_id, resource_path)) {
+    return true;
+  }
+
+  // If the request is for navigations outside of webviews, then it should be
+  // allowed. The navigation logic in CrossSiteResourceHandler will properly
+  // transfer the navigation to a privileged process before it commits.
+  if (ResourceType::IsFrame(info->GetResourceType()) && !is_guest)
+    return true;
+
+  if (!content::PageTransitionIsWebTriggerable(info->GetPageTransition()))
+    return false;
+
+  // The following checks require that we have an actual extension object. If we
+  // don't have it, allow the request handling to continue with the rest of the
+  // checks.
+  if (!extension)
+    return true;
+
+  // Disallow loading of packaged resources for hosted apps. We don't allow
+  // hybrid hosted/packaged apps. The one exception is access to icons, since
+  // some extensions want to be able to do things like create their own
+  // launchers.
+  std::string resource_root_relative_path =
+      request->url().path().empty() ? std::string()
+                                    : request->url().path().substr(1);
+  if (extension->is_hosted_app() &&
+      !IconsInfo::GetIcons(extension)
+           .ContainsPath(resource_root_relative_path)) {
+    LOG(ERROR) << "Denying load of " << request->url().spec() << " from "
+               << "hosted app.";
+    return false;
+  }
+
+  // Extensions with web_accessible_resources: allow loading by regular
+  // renderers. Since not all subresources are required to be listed in a v2
+  // manifest, we must allow all loads if there are any web accessible
+  // resources. See http://crbug.com/179127.
+  if (extension->manifest_version() < 2 ||
+      WebAccessibleResourcesInfo::HasWebAccessibleResources(extension)) {
+    return true;
+  }
+
+  // If there aren't any explicitly marked web accessible resources, the
+  // load should be allowed only if it is by DevTools. A close approximation is
+  // checking if the extension contains a DevTools page.
+  if (!ManifestURL::GetDevToolsPage(extension).is_empty())
+    return true;
+
+  // No special exception. Block the load.
+  return false;
+}
+
+net::URLRequestJob* MaybeCreateURLRequestResourceBundleJob(
+    net::URLRequest* request,
+    net::NetworkDelegate* network_delegate,
+    const base::FilePath& directory_path,
+    const std::string& content_security_policy,
+    bool send_cors_header) {
+  base::FilePath resources_path;
+  base::FilePath relative_path;
+  // Try to load extension resources from chrome resource file if
+  // directory_path is a descendant of resources_path. resources_path
+  // corresponds to src/chrome/browser/resources in source tree.
+  if (PathService::Get(chrome::DIR_RESOURCES, &resources_path) &&
+      // Since component extension resources are included in
+      // component_extension_resources.pak file in resources_path, calculate
+      // extension relative path against resources_path.
+      resources_path.AppendRelativePath(directory_path, &relative_path)) {
+    base::FilePath request_path =
+        extensions::file_util::ExtensionURLToRelativeFilePath(request->url());
+    int resource_id = 0;
+    if (extensions::ImageLoader::IsComponentExtensionResource(
+            directory_path, request_path, &resource_id)) {
+      relative_path = relative_path.Append(request_path);
+      relative_path = relative_path.NormalizePathSeparators();
+      return new URLRequestResourceBundleJob(request,
+                                             network_delegate,
+                                             relative_path,
+                                             resource_id,
+                                             content_security_policy,
+                                             send_cors_header);
+    }
+  }
+  return NULL;
+}
+
+}  // namespace url_request_util
+}  // namespace extensions
diff --git a/chrome/browser/extensions/url_request_util.h b/chrome/browser/extensions/url_request_util.h
new file mode 100644
index 0000000..a6056f3d
--- /dev/null
+++ b/chrome/browser/extensions/url_request_util.h
@@ -0,0 +1,47 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_EXTENSIONS_URL_REQUEST_UTIL_H_
+#define CHROME_BROWSER_EXTENSIONS_URL_REQUEST_UTIL_H_
+
+#include <string>
+
+namespace base {
+class FilePath;
+}
+
+namespace net {
+class NetworkDelegate;
+class URLRequest;
+class URLRequestJob;
+}
+
+namespace extensions {
+class Extension;
+class InfoMap;
+
+// Utilities related to URLRequest jobs for extension resources.
+namespace url_request_util {
+
+// Returns true to allow a chrome-extension:// resource request coming from
+// renderer A to access a resource in an extension running in renderer B.
+bool AllowCrossRendererResourceLoad(net::URLRequest* request,
+                                    bool is_incognito,
+                                    const Extension* extension,
+                                    InfoMap* extension_info_map);
+
+// Creates a URLRequestJob for loading component extension resources out of
+// a Chrome resource bundle. Returns NULL if the requested resource is not a
+// component extension resource.
+net::URLRequestJob* MaybeCreateURLRequestResourceBundleJob(
+    net::URLRequest* request,
+    net::NetworkDelegate* network_delegate,
+    const base::FilePath& directory_path,
+    const std::string& content_security_policy,
+    bool send_cors_header);
+
+}  // namespace url_request_util
+}  // namespace extensions
+
+#endif  // CHROME_BROWSER_EXTENSIONS_URL_REQUEST_UTIL_H_
diff --git a/chrome/browser/profiles/profile_impl_io_data.cc b/chrome/browser/profiles/profile_impl_io_data.cc
index a48a6b1..9af2b75 100644
--- a/chrome/browser/profiles/profile_impl_io_data.cc
+++ b/chrome/browser/profiles/profile_impl_io_data.cc
@@ -19,7 +19,6 @@
 #include "chrome/browser/chromeos/profiles/profile_helper.h"
 #include "chrome/browser/custom_handlers/protocol_handler_registry.h"
 #include "chrome/browser/custom_handlers/protocol_handler_registry_factory.h"
-#include "chrome/browser/extensions/extension_protocols.h"
 #include "chrome/browser/io_thread.h"
 #include "chrome/browser/net/chrome_net_log.h"
 #include "chrome/browser/net/chrome_network_delegate.h"
@@ -39,6 +38,7 @@
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/resource_context.h"
 #include "content/public/browser/storage_partition.h"
+#include "extensions/browser/extension_protocols.h"
 #include "extensions/common/constants.h"
 #include "net/base/cache_type.h"
 #include "net/ftp/ftp_network_layer.h"
diff --git a/chrome/browser/profiles/profile_io_data.cc b/chrome/browser/profiles/profile_io_data.cc
index 4aa1903..d8d14047 100644
--- a/chrome/browser/profiles/profile_io_data.cc
+++ b/chrome/browser/profiles/profile_io_data.cc
@@ -30,7 +30,6 @@
 #include "chrome/browser/custom_handlers/protocol_handler_registry_factory.h"
 #include "chrome/browser/download/download_service.h"
 #include "chrome/browser/download/download_service_factory.h"
-#include "chrome/browser/extensions/extension_protocols.h"
 #include "chrome/browser/extensions/extension_resource_protocols.h"
 #include "chrome/browser/io_thread.h"
 #include "chrome/browser/media/media_device_id_salt.h"
@@ -55,6 +54,7 @@
 #include "content/public/browser/host_zoom_map.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/resource_context.h"
+#include "extensions/browser/extension_protocols.h"
 #include "extensions/browser/extension_system.h"
 #include "extensions/browser/info_map.h"
 #include "extensions/common/constants.h"
@@ -1038,10 +1038,12 @@
   DCHECK(set_protocol);
 
   DCHECK(extension_info_map_.get());
+  // Check only for incognito (and not Chrome OS guest mode GUEST_PROFILE).
+  bool is_incognito = profile_type() == Profile::INCOGNITO_PROFILE;
   set_protocol = job_factory->SetProtocolHandler(
       extensions::kExtensionScheme,
-      CreateExtensionProtocolHandler(profile_type(),
-                                     extension_info_map_.get()));
+      extensions::CreateExtensionProtocolHandler(is_incognito,
+                                                 extension_info_map_.get()));
   DCHECK(set_protocol);
   set_protocol = job_factory->SetProtocolHandler(
       extensions::kExtensionResourceScheme,
diff --git a/chrome/chrome_browser_extensions.gypi b/chrome/chrome_browser_extensions.gypi
index 95c4ed1..b03411f 100644
--- a/chrome/chrome_browser_extensions.gypi
+++ b/chrome/chrome_browser_extensions.gypi
@@ -714,8 +714,6 @@
         'browser/extensions/extension_message_bubble_controller.h',
         'browser/extensions/policy_handlers.cc',
         'browser/extensions/policy_handlers.h',
-        'browser/extensions/extension_protocols.cc',
-        'browser/extensions/extension_protocols.h',
         'browser/extensions/extension_renderer_state.cc',
         'browser/extensions/extension_renderer_state.h',
         'browser/extensions/extension_resource_protocols.cc',
@@ -878,6 +876,8 @@
         'browser/extensions/updater/request_queue_impl.h',
         'browser/extensions/updater/safe_manifest_parser.cc',
         'browser/extensions/updater/safe_manifest_parser.h',
+        'browser/extensions/url_request_util.cc',
+        'browser/extensions/url_request_util.h',
         'browser/extensions/user_script_listener.cc',
         'browser/extensions/user_script_listener.h',
         'browser/extensions/user_script_master.cc',
diff --git a/chrome/chrome_tests_unit.gypi b/chrome/chrome_tests_unit.gypi
index 6b6eafde..2b1f522 100644
--- a/chrome/chrome_tests_unit.gypi
+++ b/chrome/chrome_tests_unit.gypi
@@ -537,6 +537,7 @@
         '../extensions/browser/extension_error_test_util.cc',
         '../extensions/browser/extension_error_test_util.h',
         '../extensions/browser/extension_pref_value_map_unittest.cc',
+        '../extensions/browser/extension_protocols_unittest.cc',
         '../extensions/browser/extension_registry_unittest.cc',
         '../extensions/browser/file_highlighter_unittest.cc',
         '../extensions/browser/file_reader_unittest.cc',
@@ -929,7 +930,6 @@
         'browser/extensions/extension_message_bubble_controller_unittest.cc',
         'browser/extensions/extension_prefs_unittest.cc',
         'browser/extensions/extension_prefs_unittest.h',
-        'browser/extensions/extension_protocols_unittest.cc',
         'browser/extensions/extension_service_unittest.cc',
         'browser/extensions/extension_service_unittest.h',
         'browser/extensions/extension_special_storage_policy_unittest.cc',
@@ -2053,7 +2053,6 @@
           ],
           'sources!': [
             'browser/extensions/extension_context_menu_model_unittest.cc',
-            'browser/extensions/extension_protocols_unittest.cc',
             'browser/extensions/extension_ui_unittest.cc',
             'browser/extensions/extension_web_ui_unittest.cc',
             'browser/extensions/pack_extension_unittest.cc',
diff --git a/chrome/browser/extensions/extension_protocols.cc b/extensions/browser/extension_protocols.cc
similarity index 65%
rename from chrome/browser/extensions/extension_protocols.cc
rename to extensions/browser/extension_protocols.cc
index 84299af..681a85f 100644
--- a/chrome/browser/extensions/extension_protocols.cc
+++ b/extensions/browser/extension_protocols.cc
@@ -1,8 +1,8 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/extensions/extension_protocols.h"
+#include "extensions/browser/extension_protocols.h"
 
 #include <algorithm>
 
@@ -17,21 +17,15 @@
 #include "base/metrics/histogram.h"
 #include "base/path_service.h"
 #include "base/sha1.h"
-#include "base/strings/string_number_conversions.h"
-#include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/threading/sequenced_worker_pool.h"
 #include "base/threading/thread_restrictions.h"
 #include "base/timer/elapsed_timer.h"
 #include "build/build_config.h"
-#include "chrome/browser/extensions/extension_renderer_state.h"
-#include "chrome/browser/extensions/image_loader.h"
-#include "chrome/common/chrome_paths.h"
-#include "chrome/common/extensions/manifest_url_handler.h"
-#include "chrome/common/url_constants.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/resource_request_info.h"
+#include "extensions/browser/extensions_browser_client.h"
 #include "extensions/browser/info_map.h"
 #include "extensions/common/constants.h"
 #include "extensions/common/extension.h"
@@ -43,9 +37,6 @@
 #include "extensions/common/manifest_handlers/incognito_info.h"
 #include "extensions/common/manifest_handlers/shared_module_info.h"
 #include "extensions/common/manifest_handlers/web_accessible_resources_info.h"
-#include "extensions/common/manifest_handlers/webview_info.h"
-#include "grit/component_extension_resources_map.h"
-#include "net/base/mime_util.h"
 #include "net/base/net_errors.h"
 #include "net/http/http_request_headers.h"
 #include "net/http/http_response_headers.h"
@@ -53,7 +44,6 @@
 #include "net/url_request/url_request_error_job.h"
 #include "net/url_request/url_request_file_job.h"
 #include "net/url_request/url_request_simple_job.h"
-#include "ui/base/resource/resource_bundle.h"
 #include "url/url_util.h"
 
 using content::BrowserThread;
@@ -61,127 +51,9 @@
 using extensions::Extension;
 using extensions::SharedModuleInfo;
 
+namespace extensions {
 namespace {
 
-net::HttpResponseHeaders* BuildHttpHeaders(
-    const std::string& content_security_policy, bool send_cors_header,
-    const base::Time& last_modified_time) {
-  std::string raw_headers;
-  raw_headers.append("HTTP/1.1 200 OK");
-  if (!content_security_policy.empty()) {
-    raw_headers.append(1, '\0');
-    raw_headers.append("Content-Security-Policy: ");
-    raw_headers.append(content_security_policy);
-  }
-
-  if (send_cors_header) {
-    raw_headers.append(1, '\0');
-    raw_headers.append("Access-Control-Allow-Origin: *");
-  }
-
-  if (!last_modified_time.is_null()) {
-    // Hash the time and make an etag to avoid exposing the exact
-    // user installation time of the extension.
-    std::string hash = base::StringPrintf("%" PRId64,
-                                          last_modified_time.ToInternalValue());
-    hash = base::SHA1HashString(hash);
-    std::string etag;
-    base::Base64Encode(hash, &etag);
-    raw_headers.append(1, '\0');
-    raw_headers.append("ETag: \"");
-    raw_headers.append(etag);
-    raw_headers.append("\"");
-    // Also force revalidation.
-    raw_headers.append(1, '\0');
-    raw_headers.append("cache-control: no-cache");
-  }
-
-  raw_headers.append(2, '\0');
-  return new net::HttpResponseHeaders(raw_headers);
-}
-
-class URLRequestResourceBundleJob : public net::URLRequestSimpleJob {
- public:
-  URLRequestResourceBundleJob(net::URLRequest* request,
-                              net::NetworkDelegate* network_delegate,
-                              const base::FilePath& filename,
-                              int resource_id,
-                              const std::string& content_security_policy,
-                              bool send_cors_header)
-      : net::URLRequestSimpleJob(request, network_delegate),
-        filename_(filename),
-        resource_id_(resource_id),
-        weak_factory_(this) {
-     // Leave cache headers out of resource bundle requests.
-    response_info_.headers = BuildHttpHeaders(content_security_policy,
-                                              send_cors_header,
-                                              base::Time());
-  }
-
-  // Overridden from URLRequestSimpleJob:
-  virtual int GetData(std::string* mime_type,
-                      std::string* charset,
-                      std::string* data,
-                      const net::CompletionCallback& callback) const OVERRIDE {
-    const ResourceBundle& rb = ResourceBundle::GetSharedInstance();
-    *data = rb.GetRawDataResource(resource_id_).as_string();
-
-    // Add the Content-Length header now that we know the resource length.
-    response_info_.headers->AddHeader(base::StringPrintf(
-        "%s: %s",  net::HttpRequestHeaders::kContentLength,
-        base::UintToString(data->size()).c_str()));
-
-    std::string* read_mime_type = new std::string;
-    bool posted = base::PostTaskAndReplyWithResult(
-        BrowserThread::GetBlockingPool(),
-        FROM_HERE,
-        base::Bind(&net::GetMimeTypeFromFile, filename_,
-                   base::Unretained(read_mime_type)),
-        base::Bind(&URLRequestResourceBundleJob::OnMimeTypeRead,
-                   weak_factory_.GetWeakPtr(),
-                   mime_type, charset, data,
-                   base::Owned(read_mime_type),
-                   callback));
-    DCHECK(posted);
-
-    return net::ERR_IO_PENDING;
-  }
-
-  virtual void GetResponseInfo(net::HttpResponseInfo* info) OVERRIDE {
-    *info = response_info_;
-  }
-
- private:
-  virtual ~URLRequestResourceBundleJob() { }
-
-  void OnMimeTypeRead(std::string* out_mime_type,
-                      std::string* charset,
-                      std::string* data,
-                      std::string* read_mime_type,
-                      const net::CompletionCallback& callback,
-                      bool read_result) {
-    *out_mime_type = *read_mime_type;
-    if (StartsWithASCII(*read_mime_type, "text/", false)) {
-      // All of our HTML files should be UTF-8 and for other resource types
-      // (like images), charset doesn't matter.
-      DCHECK(IsStringUTF8(*data));
-      *charset = "utf-8";
-    }
-    int result = read_result ? net::OK : net::ERR_INVALID_URL;
-    callback.Run(result);
-  }
-
-  // We need the filename of the resource to determine the mime type.
-  base::FilePath filename_;
-
-  // The resource bundle id to load.
-  int resource_id_;
-
-  net::HttpResponseInfo response_info_;
-
-  mutable base::WeakPtrFactory<URLRequestResourceBundleJob> weak_factory_;
-};
-
 class GeneratedBackgroundPageJob : public net::URLRequestSimpleJob {
  public:
   GeneratedBackgroundPageJob(net::URLRequest* request,
@@ -361,10 +233,12 @@
 }
 
 // Returns true if an chrome-extension:// resource should be allowed to load.
+// Pass true for |is_incognito| only for incognito profiles and not Chrome OS
+// guest mode profiles.
 // TODO(aa): This should be moved into ExtensionResourceRequestPolicy, but we
 // first need to find a way to get CanLoadInIncognito state into the renderers.
 bool AllowExtensionResourceLoad(net::URLRequest* request,
-                                Profile::ProfileType profile_type,
+                                bool is_incognito,
                                 const Extension* extension,
                                 extensions::InfoMap* extension_info_map) {
   const ResourceRequestInfo* info = ResourceRequestInfo::ForRequest(request);
@@ -377,9 +251,8 @@
     return true;
   }
 
-  if (profile_type == Profile::INCOGNITO_PROFILE &&
-      !ExtensionCanLoadInIncognito(info, request->url().host(),
-                                   extension_info_map)) {
+  if (is_incognito && !ExtensionCanLoadInIncognito(
+                          info, request->url().host(), extension_info_map)) {
     return false;
   }
 
@@ -401,73 +274,14 @@
     return true;
   }
 
-  // Check workers so that importScripts works from extension workers.
-  if (extension_info_map->worker_process_map().Contains(
-      request->url().host(), info->GetChildID())) {
+  // Allow the extension module embedder to grant permission for loads.
+  if (ExtensionsBrowserClient::Get()->AllowCrossRendererResourceLoad(
+          request, is_incognito, extension, extension_info_map)) {
     return true;
   }
 
-  // Extensions with webview: allow loading certain resources by guest renderers
-  // with privileged partition IDs as specified in the manifest file.
-  ExtensionRendererState* renderer_state =
-      ExtensionRendererState::GetInstance();
-  ExtensionRendererState::WebViewInfo webview_info;
-  bool is_guest = renderer_state->GetWebViewInfo(info->GetChildID(),
-                                                 info->GetRouteID(),
-                                                 &webview_info);
-  std::string resource_path = request->url().path();
-  if (is_guest && extensions::WebviewInfo::IsResourceWebviewAccessible(
-                      extension, webview_info.partition_id, resource_path)) {
-    return true;
-  }
-
-  // If the request is for navigations outside of webviews, then it should be
-  // allowed. The navigation logic in CrossSiteResourceHandler will properly
-  // transfer the navigation to a privileged process before it commits.
-  if (ResourceType::IsFrame(info->GetResourceType()) && !is_guest)
-    return true;
-
-  if (!content::PageTransitionIsWebTriggerable(info->GetPageTransition()))
-    return false;
-
-  // The following checks require that we have an actual extension object. If we
-  // don't have it, allow the request handling to continue with the rest of the
-  // checks.
-  if (!extension)
-    return true;
-
-  // Disallow loading of packaged resources for hosted apps. We don't allow
-  // hybrid hosted/packaged apps. The one exception is access to icons, since
-  // some extensions want to be able to do things like create their own
-  // launchers.
-  std::string resource_root_relative_path =
-      request->url().path().empty() ? std::string()
-                                    : request->url().path().substr(1);
-  if (extension->is_hosted_app() &&
-      !extensions::IconsInfo::GetIcons(extension)
-          .ContainsPath(resource_root_relative_path)) {
-    LOG(ERROR) << "Denying load of " << request->url().spec() << " from "
-               << "hosted app.";
-    return false;
-  }
-
-  // Extensions with web_accessible_resources: allow loading by regular
-  // renderers. Since not all subresources are required to be listed in a v2
-  // manifest, we must allow all loads if there are any web accessible
-  // resources. See http://crbug.com/179127.
-  if (extension->manifest_version() < 2 ||
-      extensions::WebAccessibleResourcesInfo::HasWebAccessibleResources(
-      extension)) {
-    return true;
-  }
-
-  // If there aren't any explicitly marked web accessible resources, the
-  // load should be allowed only if it is by DevTools. A close approximation is
-  // checking if the extension contains a DevTools page.
-  if (extensions::ManifestURL::GetDevToolsPage(extension).is_empty())
-    return false;
-
-  return true;
+  // No special exceptions for cross-process loading. Block the load.
+  return false;
 }
 
 // Returns true if the given URL references an icon in the given extension.
@@ -487,9 +301,9 @@
 class ExtensionProtocolHandler
     : public net::URLRequestJobFactory::ProtocolHandler {
  public:
-  ExtensionProtocolHandler(Profile::ProfileType profile_type,
+  ExtensionProtocolHandler(bool is_incognito,
                            extensions::InfoMap* extension_info_map)
-      : profile_type_(profile_type), extension_info_map_(extension_info_map) {}
+      : is_incognito_(is_incognito), extension_info_map_(extension_info_map) {}
 
   virtual ~ExtensionProtocolHandler() {}
 
@@ -498,7 +312,7 @@
       net::NetworkDelegate* network_delegate) const OVERRIDE;
 
  private:
-  const Profile::ProfileType profile_type_;
+  const bool is_incognito_;
   extensions::InfoMap* const extension_info_map_;
   DISALLOW_COPY_AND_ASSIGN(ExtensionProtocolHandler);
 };
@@ -514,11 +328,12 @@
 
   // TODO(mpcomplete): better error code.
   if (!AllowExtensionResourceLoad(
-          request, profile_type_, extension, extension_info_map_)) {
+          request, is_incognito_, extension, extension_info_map_)) {
     return new net::URLRequestErrorJob(
         request, network_delegate, net::ERR_ADDRESS_UNREACHABLE);
   }
 
+  // If this is a disabled extension only allow the icon to load.
   base::FilePath directory_path;
   if (extension)
     directory_path = extension->path();
@@ -533,6 +348,7 @@
     }
   }
 
+  // Set up content security policy.
   std::string content_security_policy;
   bool send_cors_header = false;
   bool follow_symlinks_anywhere = false;
@@ -553,6 +369,7 @@
         != 0;
   }
 
+  // Create a job for a generated background page.
   std::string path = request->url().path();
   if (path.size() > 1 &&
       path.substr(1) == extensions::kGeneratedBackgroundPageFilename) {
@@ -560,36 +377,22 @@
         request, network_delegate, extension, content_security_policy);
   }
 
-  base::FilePath resources_path;
-  base::FilePath relative_path;
-  // Try to load extension resources from chrome resource file if
-  // directory_path is a descendant of resources_path. resources_path
-  // corresponds to src/chrome/browser/resources in source tree.
-  if (PathService::Get(chrome::DIR_RESOURCES, &resources_path) &&
-      // Since component extension resources are included in
-      // component_extension_resources.pak file in resources_path, calculate
-      // extension relative path against resources_path.
-      resources_path.AppendRelativePath(directory_path, &relative_path)) {
-    base::FilePath request_path =
-        extensions::file_util::ExtensionURLToRelativeFilePath(request->url());
-    int resource_id;
-    if (extensions::ImageLoader::IsComponentExtensionResource(
-        directory_path, request_path, &resource_id)) {
-      relative_path = relative_path.Append(request_path);
-      relative_path = relative_path.NormalizePathSeparators();
-      return new URLRequestResourceBundleJob(
-          request,
-          network_delegate,
-          relative_path,
-          resource_id,
-          content_security_policy,
-          send_cors_header);
-    }
-  }
+  // Component extension resources may be part of the embedder's resource files,
+  // for example component_extension_resources.pak in Chrome.
+  net::URLRequestJob* resource_bundle_job =
+      extensions::ExtensionsBrowserClient::Get()
+          ->MaybeCreateResourceBundleRequestJob(request,
+                                                network_delegate,
+                                                directory_path,
+                                                content_security_policy,
+                                                send_cors_header);
+  if (resource_bundle_job)
+    return resource_bundle_job;
 
-  relative_path =
+  base::FilePath relative_path =
       extensions::file_util::ExtensionURLToRelativeFilePath(request->url());
 
+  // Handle shared resources (extension A loading resources out of extension B).
   if (SharedModuleInfo::IsImportedPath(path)) {
     std::string new_extension_id;
     std::string new_relative_path;
@@ -638,8 +441,48 @@
 
 }  // namespace
 
-net::URLRequestJobFactory::ProtocolHandler* CreateExtensionProtocolHandler(
-    Profile::ProfileType profile_type,
-    extensions::InfoMap* extension_info_map) {
-  return new ExtensionProtocolHandler(profile_type, extension_info_map);
+net::HttpResponseHeaders* BuildHttpHeaders(
+    const std::string& content_security_policy,
+    bool send_cors_header,
+    const base::Time& last_modified_time) {
+  std::string raw_headers;
+  raw_headers.append("HTTP/1.1 200 OK");
+  if (!content_security_policy.empty()) {
+    raw_headers.append(1, '\0');
+    raw_headers.append("Content-Security-Policy: ");
+    raw_headers.append(content_security_policy);
+  }
+
+  if (send_cors_header) {
+    raw_headers.append(1, '\0');
+    raw_headers.append("Access-Control-Allow-Origin: *");
+  }
+
+  if (!last_modified_time.is_null()) {
+    // Hash the time and make an etag to avoid exposing the exact
+    // user installation time of the extension.
+    std::string hash =
+        base::StringPrintf("%" PRId64, last_modified_time.ToInternalValue());
+    hash = base::SHA1HashString(hash);
+    std::string etag;
+    base::Base64Encode(hash, &etag);
+    raw_headers.append(1, '\0');
+    raw_headers.append("ETag: \"");
+    raw_headers.append(etag);
+    raw_headers.append("\"");
+    // Also force revalidation.
+    raw_headers.append(1, '\0');
+    raw_headers.append("cache-control: no-cache");
+  }
+
+  raw_headers.append(2, '\0');
+  return new net::HttpResponseHeaders(raw_headers);
 }
+
+net::URLRequestJobFactory::ProtocolHandler* CreateExtensionProtocolHandler(
+    bool is_incognito,
+    extensions::InfoMap* extension_info_map) {
+  return new ExtensionProtocolHandler(is_incognito, extension_info_map);
+}
+
+}  // namespace extensions
diff --git a/extensions/browser/extension_protocols.h b/extensions/browser/extension_protocols.h
new file mode 100644
index 0000000..2260374
--- /dev/null
+++ b/extensions/browser/extension_protocols.h
@@ -0,0 +1,40 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef EXTENSIONS_BROWSER_EXTENSION_PROTOCOLS_H_
+#define EXTENSIONS_BROWSER_EXTENSION_PROTOCOLS_H_
+
+#include <string>
+
+#include "net/url_request/url_request_job_factory.h"
+
+namespace base {
+class Time;
+}
+
+namespace net {
+class HttpResponseHeaders;
+}
+
+namespace extensions {
+
+class InfoMap;
+
+// Builds HTTP headers for an extension request. Hashes the time to avoid
+// exposing the exact user installation time of the extension.
+net::HttpResponseHeaders* BuildHttpHeaders(
+    const std::string& content_security_policy,
+    bool send_cors_header,
+    const base::Time& last_modified_time);
+
+// Creates the handlers for the chrome-extension:// scheme. Pass true for
+// |is_incognito| only for incognito profiles and not for Chrome OS guest mode
+// profiles.
+net::URLRequestJobFactory::ProtocolHandler* CreateExtensionProtocolHandler(
+    bool is_incognito,
+    extensions::InfoMap* extension_info_map);
+
+}  // namespace extensions
+
+#endif  // EXTENSIONS_BROWSER_EXTENSION_PROTOCOLS_H_
diff --git a/chrome/browser/extensions/extension_protocols_unittest.cc b/extensions/browser/extension_protocols_unittest.cc
similarity index 95%
rename from chrome/browser/extensions/extension_protocols_unittest.cc
rename to extensions/browser/extension_protocols_unittest.cc
index fd9d82a..0aa097b 100644
--- a/chrome/browser/extensions/extension_protocols_unittest.cc
+++ b/extensions/browser/extension_protocols_unittest.cc
@@ -1,4 +1,4 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
@@ -9,12 +9,12 @@
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "base/values.h"
-#include "chrome/browser/extensions/extension_protocols.h"
 #include "chrome/common/chrome_paths.h"
-#include "chrome/common/url_constants.h"
+//#include "chrome/common/url_constants.h"
 #include "content/public/browser/resource_request_info.h"
 #include "content/public/test/mock_resource_context.h"
 #include "content/public/test/test_browser_thread_bundle.h"
+#include "extensions/browser/extension_protocols.h"
 #include "extensions/browser/info_map.h"
 #include "extensions/common/constants.h"
 #include "extensions/common/extension.h"
@@ -89,8 +89,9 @@
 class ExtensionProtocolTest : public testing::Test {
  public:
   ExtensionProtocolTest()
-    : thread_bundle_(content::TestBrowserThreadBundle::IO_MAINLOOP),
-      resource_context_(&test_url_request_context_) {}
+      : thread_bundle_(content::TestBrowserThreadBundle::IO_MAINLOOP),
+        old_factory_(NULL),
+        resource_context_(&test_url_request_context_) {}
 
   virtual void SetUp() OVERRIDE {
     testing::Test::SetUp();
@@ -106,12 +107,12 @@
     request_context->set_job_factory(old_factory_);
   }
 
-  void SetProtocolHandler(Profile::ProfileType profile_type) {
+  void SetProtocolHandler(bool is_incognito) {
     net::URLRequestContext* request_context =
         resource_context_.GetRequestContext();
     job_factory_.SetProtocolHandler(
         kExtensionScheme,
-        CreateExtensionProtocolHandler(profile_type,
+        CreateExtensionProtocolHandler(is_incognito,
                                        extension_info_map_.get()));
     request_context->set_job_factory(&job_factory_);
   }
@@ -145,7 +146,7 @@
 // extension).
 TEST_F(ExtensionProtocolTest, IncognitoRequest) {
   // Register an incognito extension protocol handler.
-  SetProtocolHandler(Profile::INCOGNITO_PROFILE);
+  SetProtocolHandler(true);
 
   struct TestCase {
     // Inputs.
@@ -224,7 +225,7 @@
 // the extension is enabled and when it is disabled.
 TEST_F(ExtensionProtocolTest, ComponentResourceRequest) {
   // Register a non-incognito extension protocol handler.
-  SetProtocolHandler(Profile::REGULAR_PROFILE);
+  SetProtocolHandler(false);
 
   scoped_refptr<Extension> extension = CreateWebStoreExtension();
   extension_info_map_->AddExtension(extension.get(),
@@ -261,7 +262,7 @@
 // expected response headers.
 TEST_F(ExtensionProtocolTest, ResourceRequestResponseHeaders) {
   // Register a non-incognito extension protocol handler.
-  SetProtocolHandler(Profile::REGULAR_PROFILE);
+  SetProtocolHandler(false);
 
   scoped_refptr<Extension> extension = CreateTestResponseHeaderExtension();
   extension_info_map_->AddExtension(extension.get(),
@@ -299,7 +300,7 @@
 // succeeds, but subresources fail. See http://crbug.com/312269.
 TEST_F(ExtensionProtocolTest, AllowFrameRequests) {
   // Register a non-incognito extension protocol handler.
-  SetProtocolHandler(Profile::REGULAR_PROFILE);
+  SetProtocolHandler(false);
 
   scoped_refptr<Extension> extension = CreateTestExtension("foo", false);
   extension_info_map_->AddExtension(extension.get(),
diff --git a/extensions/browser/extensions_browser_client.h b/extensions/browser/extensions_browser_client.h
index c7542a79..d7c02d9 100644
--- a/extensions/browser/extensions_browser_client.h
+++ b/extensions/browser/extensions_browser_client.h
@@ -16,6 +16,7 @@
 
 namespace base {
 class CommandLine;
+class FilePath;
 }
 
 namespace content {
@@ -23,6 +24,12 @@
 class WebContents;
 }
 
+namespace net {
+class NetworkDelegate;
+class URLRequest;
+class URLRequestJob;
+}
+
 namespace extensions {
 
 class ApiActivityMonitor;
@@ -32,6 +39,7 @@
 class ExtensionPrefsObserver;
 class ExtensionSystem;
 class ExtensionSystemProvider;
+class InfoMap;
 
 // Interface to allow the extensions module to make browser-process-specific
 // queries of the embedder. Should be Set() once in the browser process.
@@ -88,6 +96,26 @@
       const extensions::Extension* extension,
       content::BrowserContext* context) const = 0;
 
+  // Returns an URLRequestJob to load an extension resource from the embedder's
+  // resource bundle (.pak) files. Returns NULL if the request is not for a
+  // resource bundle resource or if the embedder does not support this feature.
+  // Used for component extensions. Called on the IO thread.
+  virtual net::URLRequestJob* MaybeCreateResourceBundleRequestJob(
+      net::URLRequest* request,
+      net::NetworkDelegate* network_delegate,
+      const base::FilePath& directory_path,
+      const std::string& content_security_policy,
+      bool send_cors_header) = 0;
+
+  // Returns true if the embedder wants to allow a chrome-extension:// resource
+  // request coming from renderer A to access a resource in an extension running
+  // in renderer B. For example, Chrome overrides this to provide support for
+  // webview and dev tools. Called on the IO thread.
+  virtual bool AllowCrossRendererResourceLoad(net::URLRequest* request,
+                                              bool is_incognito,
+                                              const Extension* extension,
+                                              InfoMap* extension_info_map) = 0;
+
   // Returns the PrefService associated with |context|.
   virtual PrefService* GetPrefServiceForContext(
       content::BrowserContext* context) = 0;
diff --git a/extensions/browser/test_extensions_browser_client.cc b/extensions/browser/test_extensions_browser_client.cc
index f1d3cc9..132ac19 100644
--- a/extensions/browser/test_extensions_browser_client.cc
+++ b/extensions/browser/test_extensions_browser_client.cc
@@ -83,6 +83,24 @@
   return false;
 }
 
+net::URLRequestJob*
+TestExtensionsBrowserClient::MaybeCreateResourceBundleRequestJob(
+    net::URLRequest* request,
+    net::NetworkDelegate* network_delegate,
+    const base::FilePath& directory_path,
+    const std::string& content_security_policy,
+    bool send_cors_header) {
+  return NULL;
+}
+
+bool TestExtensionsBrowserClient::AllowCrossRendererResourceLoad(
+    net::URLRequest* request,
+    bool is_incognito,
+    const Extension* extension,
+    InfoMap* extension_info_map) {
+  return false;
+}
+
 PrefService* TestExtensionsBrowserClient::GetPrefServiceForContext(
     BrowserContext* context) {
   return NULL;
diff --git a/extensions/browser/test_extensions_browser_client.h b/extensions/browser/test_extensions_browser_client.h
index 4db3270..ee3a6255 100644
--- a/extensions/browser/test_extensions_browser_client.h
+++ b/extensions/browser/test_extensions_browser_client.h
@@ -42,6 +42,17 @@
   virtual bool CanExtensionCrossIncognito(
       const extensions::Extension* extension,
       content::BrowserContext* context) const OVERRIDE;
+  virtual net::URLRequestJob* MaybeCreateResourceBundleRequestJob(
+      net::URLRequest* request,
+      net::NetworkDelegate* network_delegate,
+      const base::FilePath& directory_path,
+      const std::string& content_security_policy,
+      bool send_cors_header) OVERRIDE;
+  virtual bool AllowCrossRendererResourceLoad(net::URLRequest* request,
+                                              bool is_incognito,
+                                              const Extension* extension,
+                                              InfoMap* extension_info_map)
+      OVERRIDE;
   virtual PrefService* GetPrefServiceForContext(
       content::BrowserContext* context) OVERRIDE;
   virtual void GetEarlyExtensionPrefsObservers(
diff --git a/extensions/extensions.gyp b/extensions/extensions.gyp
index 4227cc0..bf4a61d 100644
--- a/extensions/extensions.gyp
+++ b/extensions/extensions.gyp
@@ -327,6 +327,8 @@
         'browser/extension_prefs_factory.h',
         'browser/extension_prefs_observer.h',
         'browser/extension_prefs_scope.h',
+        'browser/extension_protocols.cc',
+        'browser/extension_protocols.h',
         'browser/extension_registry.cc',
         'browser/extension_registry.h',
         'browser/extension_registry_factory.cc',