Allow Chrome pages to use chrome://theme resources as mask images

As of CL 1838592, -webkit-mask-image now uses CORS-enabled loading,
blocking chrome:// pages from using chrome://theme resources as mask
images. This only applies to OOBE and the WebUI tab strip currently.

Change-Id: I10f8a0e68ff2de4603a7bbb816c1f1c4a42b76e9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1855182Reviewed-by: Xiaocheng Hu <xiaochengh@chromium.org>
Reviewed-by: Demetrios Papadopoulos <dpapad@chromium.org>
Commit-Queue: John Lee <johntlee@chromium.org>
Cr-Commit-Position: refs/heads/master@{#705596}

chrome/browser/ui/webui/theme_source.cc

@@ -7,6 +7,7 @@
 #include "base/bind.h"
 #include "base/memory/ref_counted_memory.h"
 #include "base/strings/string_number_conversions.h"
+#include "base/strings/string_util.h"
 #include "base/task/post_task.h"
 #include "build/branding_buildflags.h"
 #include "chrome/browser/profiles/profile.h"
@@ -24,6 +25,8 @@
 #include "components/version_info/version_info.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/browser/url_data_source.h"
+#include "content/public/common/url_constants.h"
 #include "net/url_request/url_request.h"
 #include "ui/base/layout.h"
 #include "ui/base/resource/resource_bundle.h"
@@ -239,3 +242,15 @@ void ThemeSource::SendThemeImage(
         base::BindOnce(callback, data));
   }
 }
+
+std::string ThemeSource::GetAccessControlAllowOriginForOrigin(
+    const std::string& origin) {
+  std::string allowed_origin_prefix = content::kChromeUIScheme;
+  allowed_origin_prefix += "://";
+  if (base::StartsWith(origin, allowed_origin_prefix,
+                       base::CompareCase::SENSITIVE)) {
+    return origin;
+  }
+
+  return content::URLDataSource::GetAccessControlAllowOriginForOrigin(origin);
+}

chrome/browser/ui/webui/theme_source.h

@@ -33,6 +33,8 @@ class ThemeSource : public content::URLDataSource {
   bool ShouldServiceRequest(const GURL& url,
                             content::ResourceContext* resource_context,
                             int render_process_id) override;
+  std::string GetAccessControlAllowOriginForOrigin(
+      const std::string& origin) override;
 
  private:
   // Fetches and sends the theme bitmap.

chrome/browser/ui/webui/theme_source_unittest.cc

@@ -94,3 +94,15 @@ TEST_F(WebUISourcesTest, ThemeSourceCSS) {
   EXPECT_EQ(result_data_size_, empty_size);
 #endif
 }
+
+TEST_F(WebUISourcesTest, ThemeAllowedOrigin) {
+  EXPECT_EQ(
+      theme_source()->GetAccessControlAllowOriginForOrigin("chrome://settings"),
+      "chrome://settings");
+  EXPECT_EQ(theme_source()->GetAccessControlAllowOriginForOrigin(
+                "chrome-extensions://some-id"),
+            "");
+  EXPECT_EQ(
+      theme_source()->GetAccessControlAllowOriginForOrigin("http://google.com"),
+      "");
+}