Make downloads.download() respect host permissions

chrome/browser/download/download_extension_api.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/download/download_extension_api.h"
 
 #include <algorithm>
 #include <cctype>
 #include <iterator>
 #include <set>
@@ skipping 363 matching lines @@
   std::string url;
   iodata_.reset(new IOData());
   EXTENSION_FUNCTION_VALIDATE(args_->GetDictionary(0, &options));
   EXTENSION_FUNCTION_VALIDATE(options->GetString(kUrlKey, &url));
   iodata_->url = GURL(url);
   if (!iodata_->url.is_valid()) {
     error_ = download_extension_errors::kInvalidURLError;
     return false;
   }
 
+  if (!iodata_->url.SchemeIs("data") &&
+      !iodata_->url.SchemeIs("filesystem") &&

[Aaron Boodman, 2012/05/02 22:52:07]

Isn't this a way to circumvent host permissions? The extension will be able to
download filesystem:http://www.google.com, even if it doesn't have host
permissions to google.com. That doesn't seem right?

I'm not sure about blobs. Are blobs tied to an origin? Or are they globally
unique ids? If the latter, I suppose the extension would have had already had to
have access to an origin in order to get the blob URL in the first place, so it
is fine.

[ericu, 2012/05/02 23:26:32]

Yeah, this isn't right.  Just take !iodata_->url.SchemeIs("filesystem") off the
restriction list.  Once https://chromiumcodereview.appspot.com/10224011/ lands,
HasHostPermission will do the right thing with filesystem URLs.  And before it's
landed, this check as written would be a security hole, as Aaron points out.
Blobs are tied to an origin, but I don't know if you can view them cross-origin
or not.  MichaelN says you can.  I'd suggest checking with abarth if you want a
security expert opinion.

+      !iodata_->url.SchemeIs("blob") &&
+      !GetExtension()->HasHostPermission(iodata_->url)) {
+    error_ = download_extension_errors::kInvalidURLError;
+    return false;
+  }
+
   if (options->HasKey(kFilenameKey)) {
     EXTENSION_FUNCTION_VALIDATE(options->GetString(
         kFilenameKey, &iodata_->filename));
     if (!ValidateFilename(iodata_->filename)) {
       error_ = download_extension_errors::kGenericError;
       return false;
     }
   }
 
   if (options->HasKey(kSaveAsKey)) {
@@ skipping 681 matching lines @@
   ListValue args;
   args.Append(arg);
   std::string json_args;
   base::JSONWriter::Write(&args, &json_args);
   profile_->GetExtensionEventRouter()->DispatchEventToRenderers(
       event_name,
       json_args,
       profile_,
       GURL());
 }