Fix web_accesible_resources enforcement for Site Isolation.
When --isolate-extensions or --site-per-process modes are enabled, all
extensions frames run in extension processes and are not mixed in regular
web renderers. This causes a problem with security checks for
web_accessible_resources, which allow all navigations to extension pages
when they are performed in extension process. This is no longer true and
this patch addresses this by using a NavigationThrottle to perform the
proper checks on the UI thread (also PlzNavigate compatible).
BUG=616488
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_site_isolation
Review-Url: https://codereview.chromium.org/2042483002
Cr-Commit-Position: refs/heads/master@{#398189}
diff --git a/chrome/browser/extensions/extension_protocols_unittest.cc b/chrome/browser/extensions/extension_protocols_unittest.cc
index 96cd5f4..89d7371 100644
--- a/chrome/browser/extensions/extension_protocols_unittest.cc
+++ b/chrome/browser/extensions/extension_protocols_unittest.cc
@@ -211,7 +211,7 @@
// First test a main frame request.
{
// It doesn't matter that the resource doesn't exist. If the resource
- // is blocked, we should see ADDRESS_UNREACHABLE. Otherwise, the request
+ // is blocked, we should see BLOCKED_BY_CLIENT. Otherwise, the request
// should just fail because the file doesn't exist.
std::unique_ptr<net::URLRequest> request(
resource_context_.GetRequestContext()->CreateRequest(
@@ -224,8 +224,8 @@
EXPECT_EQ(net::ERR_FILE_NOT_FOUND, request->status().error()) <<
cases[i].name;
} else {
- EXPECT_EQ(net::ERR_ADDRESS_UNREACHABLE, request->status().error()) <<
- cases[i].name;
+ EXPECT_EQ(net::ERR_BLOCKED_BY_CLIENT, request->status().error())
+ << cases[i].name;
}
}
@@ -242,8 +242,8 @@
EXPECT_EQ(net::ERR_FILE_NOT_FOUND, request->status().error()) <<
cases[i].name;
} else {
- EXPECT_EQ(net::ERR_ADDRESS_UNREACHABLE, request->status().error()) <<
- cases[i].name;
+ EXPECT_EQ(net::ERR_BLOCKED_BY_CLIENT, request->status().error())
+ << cases[i].name;
}
}
}
