Make downloads.download() respect host permissions

chrome/browser/download/download_extension_api.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/download/download_extension_api.h"
 
 #include <algorithm>
 #include <cctype>
 #include <iterator>
 #include <set>
@@ skipping 351 matching lines @@
     method("GET"),
     rdh(NULL),
     resource_context(NULL),
     render_process_host_id(0),
     render_view_host_routing_id(0) {
 }
 
 DownloadsDownloadFunction::IOData::~IOData() {}
 
 bool DownloadsDownloadFunction::ParseArgs() {
   base::DictionaryValue* options = NULL;

[Aaron Boodman, 2012/05/14 21:32:13]

For future CL: You should change this to use JSON Schema Compiler. It would
eliminate a lot of this error-prone manual parsing. See the alarms API for an
example of how.

[benjhayden, 2012/05/15 17:47:01]

That does look handy.
Thanks!

   std::string url;
   iodata_.reset(new IOData());
   EXTENSION_FUNCTION_VALIDATE(args_->GetDictionary(0, &options));
   EXTENSION_FUNCTION_VALIDATE(options->GetString(kUrlKey, &url));
   iodata_->url = GURL(url);
   if (!iodata_->url.is_valid()) {
     error_ = download_extension_errors::kInvalidURLError;
     return false;
   }
 
+  if (!iodata_->url.SchemeIs("data") &&

[Aaron Boodman, 2012/05/14 21:32:13]

Is there a use case for downloading a data URL?

[benjhayden, 2012/05/15 17:47:01]

Many websites use data URLs for images, and an extension may want to download
those images.
Some people generate data urls in javascript for short audio files. Somebody may
want to write an extension for generating and saving sound effects or other
snippets of audio.
Any kind of small resource can be transmitted or generated as a data url, and an
extension may want to download any kind of resource.
If download() blocked data urls, then extensions could get around it by writing
the data to a blob and downloading the filesystem: URL.

+      iodata_->url.GetOrigin() != GetExtension()->url().GetOrigin() &&
+      !GetExtension()->HasHostPermission(iodata_->url)) {
+    error_ = download_extension_errors::kInvalidURLError;
+    return false;
+  }
+
   if (options->HasKey(kFilenameKey)) {
     EXTENSION_FUNCTION_VALIDATE(options->GetString(
         kFilenameKey, &iodata_->filename));
     if (!ValidateFilename(iodata_->filename)) {
       error_ = download_extension_errors::kGenericError;
       return false;
     }
   }
 
   if (options->HasKey(kSaveAsKey)) {
@@ skipping 681 matching lines @@
   ListValue args;
   args.Append(arg);
   std::string json_args;
   base::JSONWriter::Write(&args, &json_args);
   profile_->GetExtensionEventRouter()->DispatchEventToRenderers(
       event_name,
       json_args,
       profile_,
       GURL());
 }