Make downloads.download() respect host permissions

chrome/browser/download/download_extension_api.cc

Index: chrome/browser/download/download_extension_api.cc
diff --git a/chrome/browser/download/download_extension_api.cc b/chrome/browser/download/download_extension_api.cc
index cdf0193ff2ef33882e4c8323ea762f597ede8def..a892675b3302abb791ead56b385dfe2b6b9f007a 100644
--- a/chrome/browser/download/download_extension_api.cc
+++ b/chrome/browser/download/download_extension_api.cc
@@ -380,6 +380,13 @@ bool DownloadsDownloadFunction::ParseArgs() {
     return false;
   }
 
+  if (!iodata_->url.SchemeIs("data") &&

[Aaron Boodman, 2012/05/14 21:32:13]

Is there a use case for downloading a data URL?

[benjhayden, 2012/05/15 17:47:01]

Many websites use data URLs for images, and an extension may want to download
those images.
Some people generate data urls in javascript for short audio files. Somebody may
want to write an extension for generating and saving sound effects or other
snippets of audio.
Any kind of small resource can be transmitted or generated as a data url, and an
extension may want to download any kind of resource.
If download() blocked data urls, then extensions could get around it by writing
the data to a blob and downloading the filesystem: URL.

+      iodata_->url.GetOrigin() != GetExtension()->url().GetOrigin() &&
+      !GetExtension()->HasHostPermission(iodata_->url)) {
+    error_ = download_extension_errors::kInvalidURLError;
+    return false;
+  }
+
   if (options->HasKey(kFilenameKey)) {
     EXTENSION_FUNCTION_VALIDATE(options->GetString(
         kFilenameKey, &iodata_->filename));