Question

Where can I find in Chromium Code Source the blacklist regarding the webRequest API?

The webRequest API only exposes requests that the extension has
permission to see, given its host permissions. Moreover, only the
following schemes are accessible: http://, https://, ftp://, file://,
or chrome-extension://. In addition, even certain requests with URLs
using one of the above schemes are hidden, e.g.,
chrome-extension://other_extension_id where other_extension_id is not
the ID of the extension to handle the request,
https://www.google.com/chrome, and others (this list is not complete).

Source: https://developer.chrome.com/extensions/webRequest.html#life_cycle_footnote

Answer 1

1. Implementation: chromium/src/chrome/browser/extensions/api/web_request/web_request_permissions.cc
2. Unit tests: chromium/src/chrome/browser/extensions/api/web_request/web_request_permissions_unittest.cc

The following URLs are blacklisted (patterns can be derived from the source code and/or unit tests):

      "http://clients2.google.com",
      "http://clients22.google.com",
      "https://clients2.google.com",
      "http://clients2.google.com/service/update2/crx",
      "https://clients.google.com",
      "https://test.clients.google.com",
      "https://clients2.google.com/service/update2/crx",
      "http://www.gstatic.com/chrome/extensions/blacklist",
      "https://www.gstatic.com/chrome/extensions/blacklist",
      "notregisteredscheme://www.foobar.com"