[Backport] CVE-2025-0443: Insufficient data validation in Extensions

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/devtools/devtools-frontend/+/5987430:
Protect canAccessResource in DevTools API form prototype pollution

Bug: 376625003
Change-Id: Ib07a65da8f342c4727bceb6afcbd920bcfd07b81
Reviewed-on: https://chromium-review.googlesource.com/c/devtools/devtools-frontend/+/5987430
Reviewed-by: Philip Pfaffe <[email protected]>
Commit-Queue: Danil Somsikov <[email protected]>
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/619214
Reviewed-by: Anu Aliyas <[email protected]>

Author: danilsomsikov

chromium/third_party/devtools-frontend/src/front_end/models/extensions/ExtensionAPI.ts

@@ -1172,9 +1172,17 @@ self.injectedExtensionAPI = function(
     this.onRecordingStopped = new (Constructor(EventSink))(PrivateAPI.Events.RecordingStopped + id);
   }
 
+  const protocolGet = Object.getOwnPropertyDescriptor(URL.prototype, 'protocol')?.get;
+  function getProtocol(url: string): string {
+    if (!protocolGet) {
+      throw new Error('URL.protocol is not available');
+    }
+    return protocolGet.call(new URL(url));
+  }
+
   function canAccessResource(resource: APIImpl.ResourceData): boolean {
     try {
-      return extensionInfo.allowFileAccess || (new URL(resource.url)).protocol !== 'file:';
+      return extensionInfo.allowFileAccess || getProtocol(resource.url) !== 'file:';
     } catch (e) {
       return false;
     }