Allowlist Gaia origin for privileged chrome Javascript API

The code is still behind a feature toggle and not fully implemented.
Follow-up patches will introduce interactions with the browser process
via Mojo.

Independently of the browser process enforcing security origin checks,
the Javascript API itself should also be exposed only to the Gaia
origin.

Bug: 1000146
Change-Id: Ib95bf8e66db6643352c92939d7c3444fe0231247
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1813304Reviewed-by: David Roger <droger@chromium.org>
Commit-Queue: Mikel Astiz <mastiz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#698423}

chrome/renderer/DEPS

@@ -57,6 +57,7 @@ include_rules = [
   "+extensions/buildflags",
   "+extensions/renderer",
   "+gin",
+  "+google_apis",
   "+media/base",
   "+ppapi/shared_impl",
   "+services/network/public/cpp",

chrome/renderer/sync_encryption_keys_extension.cc

@@ -9,12 +9,26 @@
 
 #include "base/bind.h"
 #include "base/logging.h"
+#include "base/no_destructor.h"
 #include "content/public/renderer/chrome_object_extensions_utils.h"
 #include "content/public/renderer/render_frame.h"
 #include "gin/arguments.h"
 #include "gin/function_template.h"
+#include "google_apis/gaia/gaia_urls.h"
 #include "third_party/blink/public/web/blink.h"
 #include "third_party/blink/public/web/web_local_frame.h"
+#include "url/origin.h"
+
+namespace {
+
+const url::Origin& GetAllowedOrigin() {
+  static const base::NoDestructor<url::Origin> origin(
+      url::Origin::Create(GaiaUrls::GetInstance()->gaia_url()));
+  CHECK(!origin->opaque());
+  return *origin;
+}
+
+}  // namespace
 
 // static
 void SyncEncryptionKeysExtension::Create(content::RenderFrame* frame) {
@@ -32,8 +46,14 @@ void SyncEncryptionKeysExtension::OnDestruct() {
 }
 
 void SyncEncryptionKeysExtension::DidClearWindowObject() {
-  // TODO(crbug.com/1000146): This API should be restricted to allowed origins.
-  Install();
+  if (!render_frame()) {
+    return;
+  }
+
+  url::Origin origin = render_frame()->GetWebFrame()->GetSecurityOrigin();
+  if (origin == GetAllowedOrigin()) {
+    Install();
+  }
 }
 
 void SyncEncryptionKeysExtension::Install() {